CVE-2026-21589 is a critical, unauthenticated arbitrary file access flaw in eight self-managed Atlassian products, including Jira, Confluence, Bitbucket, Bamboo and Crowd. Atlassian published the advisory on October 5, 2026 and rates it CVSS 9.3. If you run any affected product, upgrade to your product’s fixed version or later. If you can’t upgrade today, take the instance off the public internet and add a WAF or proxy rule as a stopgap. Atlassian says Cloud customers need to do nothing.
Which products are affected
Atlassian says all versions before the listed fixes of these eight products are affected: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. The flaw is not limited to recent releases, so an old installation that never received updates is in scope.
As an Amazon Associate I earn from qualifying purchases.
Atlassian Cloud is treated separately (see the Cloud section below).
Fixed versions by product
Atlassian recommends upgrading each installation to the fixed version listed for its branch, or to a later one. It also advises using a fixed LTS version or later. All figures below come from Atlassian’s October 5, 2026 advisory.
#1 Best Overall
- 【Powerful Load-bearing】12U Network Rack Open Frame is constructed from durable cold rolled steel; Rack shelf supports enhance stability, wall-mounted capacity of 130lbs, the ground-mounted up to 260lbs
- 【Considerate Designs】Open-frame layout, including a top panel adding space, anti-slip shelf stops fixing devices and compatible racks for stack and expansion to meet requirements of home server rack
- 【Complete Accessories】A 12U open frame server rack, two ventilated shelves, four shelf stops, four velcro straps and a set of equipment mounting screws
- 【Versatile Application】Ideal for space-efficient multi-device setups in warehouses, retail, classrooms, offices and more; Excellent choices as AV Rack/IT Rack
- 【Effortless Setup】 Network Rack includes hardware, a comprehensive manual, mounting hole drilling template and an online assembly video to simplify setup
| Product | Fixed versions listed |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
Atlassian’s Jira Software Data Center issue entry also lists the 9.12.40, 10.3.26 and 11.3.12 fixes, so those numbers appear in more than one Atlassian place.
Choosing the right target
- Match your current release line to the closest fixed version in the same row. For example, a Confluence 9.2.x site goes to 9.2.26 or later, and a 10.2.x site goes to 10.2.19 or later.
- If your version is on a line that doesn’t appear in your product’s row, the advisory’s guidance is to move to a fixed LTS version or later. Check Atlassian’s current release notes for the supported target.
- Jira Software and Jira Service Management share the 10.3.26 and 11.3.12 numbers but use different older lines (9.12.40 for Software, 5.12.40 for Service Management). Don’t mix them up.
Release listings can change quickly after an advisory, so confirm the latest builds in Atlassian’s release notes before you schedule the upgrade.
Rank #2
- Save valuable floor space: 6U wall mount server cabinet Dimensions: 13.78" H x21.65" W x17.72" D.Maximum mounting depth is 14.2"
- Keep critical network equipment secure: glass door and side panels are lockable to prevent unauthorized access. Front door can be installed on either side of the front of the cabinet to satisfy your door swing orientation preference
- Easy equipment configuration: Fully adjustable mounting rails and numbered U positions, with square holes for easy equipment mounting with top and bottom punch-out panels for easy cable access
- Durability: Made of high quality cold rolled steel holds up to 110lb (50kg) (Easy Assembly Required)
- PCI & HIPPA and EIA/ECA-310-E compliant
What the flaw lets an attacker do
According to the advisory, an unauthenticated attacker can read specific files inside the web application root, but only if they already know the exact file name and path. Atlassian puts it this way: “Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.”
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThat makes it narrower than unrestricted filesystem access, and the advisory describes file access, not code execution. It does not require a login. Atlassian adds that sensitive files present in some configurations can increase risk. The exact-path requirement is a hurdle, not a safeguard: files whose names and locations are predictable are the ones to worry about, and nothing in the advisory suggests authentication slows an attacker down.
Rank #3
- Save valuable floor space: 12U wall mount server cabinet Dimensions: 24.25" H x21.65" W x17.72" D. MAXIMUM MOUNTING DEPTH is 14.2".
- Keep critical network equipment secure: glass door and side panels are lockable to prevent unauthorized access; Front door can be installed on either side of the front of the cabinet to satisfy your door swing orientation preference
- Easy equipment configuration: Fully adjustable mounting rails and numbered U positions, with square holes for easy equipment mounting with top and bottom punchout panels for easy cable access
- Durability: Made of high quality cold rolled steel holds up to 110lb (50kg) (Easy Assembly Required)
- PCI & HIPPA and EIA/ECA-310-E compliant
How to read the 9.3 score
The score is Atlassian’s own internal assessment, using CVSS 4.0 with the vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H. Read against the standard CVSS 4.0 metric definitions:
- AV:N / AC:L / AT:N / PR:N / UI:N — exploitable over the network, low complexity, no special attack conditions, no privileges and no user interaction.
- VC:H, VI:N, VA:N — high confidentiality impact on the vulnerable system, but no direct integrity or availability impact.
- SC:H / SI:H / SA:H — high impact rated on subsequent (connected) systems.
Atlassian tells readers to evaluate how the issue applies to their own environment. What sits in your web root, and whether the instance is internet-facing, will decide your real exposure.
Rank #4
- ADJUSTABLE DEPTH: 4-Post 42U open frame server rack with 4 vertical rails and adjustable mounting depth 22" to 40" (56,0cm to 101,7cm); Compatible with various servers / switches / data / AV and other IT equipment; EIA/ECA-310-E Compliant
- EASY ASSEMBLY: Mobile network rack with easy-to-follow assembly instructions and online video; Compact flat-pack shipping to avoid damage and facilitate installation; Total product height of 80.3in (204 cm) with casters, 78in (198cm) without casters
- COLD ROLLED STEEL: Durable 4 Post 19in open frame rack designed for ventilation with 42U mounting height and 1320lb (600kg) weight capacity (stationary); 3 install options included: casters, levelling feet, or base-plate to secure rack to the floor
- HARDWARE INCLUDED: Rolling computer/data rack includes cage nuts and screws to mount equipment, easy to read Units (U) and depth adjustment markings, cable management hooks for organization, and required assembly tools
- THE IT PRO'S CHOICE: Designed and built for IT Professionals, this 42U rack is backed for 2-years, including free lifetime 24/5 multi-lingual technical assistance
If you can’t patch right away
Atlassian’s interim guidance has two parts. Neither replaces the upgrade.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall1. Cut off external access
Where possible, remove the instance from the internet until it is patched or mitigated. Atlassian specifically says publicly reachable instances should be restricted from external network access, including instances protected by user authentication. Because the flaw is pre-auth, a login page does not protect you.
Best Value
- 【Powerful load-bearing】 Constructed from durable Cold Rolled Steel, Rack Shelf Back Support enhances stability, wall-mounted capacity of 130lbs, the ground-mounted up to 260lbs
- 【Considerate Designs】Open-frame layout, including a top panel adding space, Anti-Slip Shelf Stops fixing devices and compatible racks for stack and expansion to meet requirements of home server rack
- 【Complete Accessories】A 16U open frame server rack, two ventilated shelves, four shelf stops, four velcro straps and a set of equipment mounting screws
- 【Versatile Application】Ideal for space-efficient multi-device setups in warehouses, retail, classrooms, offices and more; Excellent choices as AV Rack/IT Rack
- 【Effortless Setup】 Network Rack includes hardware, a comprehensive manual, mounting hole drilling template and an online assembly video to simplify setup
In practice that can mean a VPN, a zero-trust gateway or an IP allow-list. For Bitbucket, Bamboo, Crucible and Fisheye, which are often reached by CI systems or developers, check what depends on the public endpoint before you close it.
2. Add the vendor’s WAF or proxy rule
For all affected products, Atlassian supplies a temporary WAF or proxy rule. It uses a regular expression to block .. when it sits directly next to /, \ or ::, including URL-encoded variants. In effect it is a path-traversal filter.
- Copy the exact expression and implementation notes from Atlassian’s advisory. Don’t retype it from a summary, because one wrong character can silently disable the rule or break legitimate traffic.
- Atlassian says to test that the rule really blocks these forms. How you deploy it depends on your WAF or reverse-proxy technology.
- We have not independently tested the rule. Treat it as a stopgap and verify it in your own environment.
Precautions after you patch
These steps are general hardening advice, not Atlassian instructions. No public indicators of compromise have been issued for this CVE.
- Review web server and proxy logs for the period before you patched. Look for requests containing
..sequences, encoded variants, or unusual direct requests for configuration-style files. A hit proves nothing on its own, and a clean log is not proof of safety, but it tells you where to look. - Check what’s in the web application root. Backup files, copied configs or other stray files placed there are the likeliest sources of leaked secrets. Remove them.
- Rotate credentials that could have appeared in any exposed file if the instance was internet-reachable and unpatched. That includes database passwords, API tokens and service-account secrets.
Atlassian Cloud
Atlassian states that affected Cloud products have already been patched, that its investigation found no evidence of exploitation, and that no Cloud customer action is required. Both claims come from Atlassian alone; no independent telemetry confirms or contradicts them, and they say nothing about self-managed servers.
What isn’t known yet
As of October 7, 2026, the advisory gives no counts of affected or compromised installations, and we are not aware of independent technical write-ups or detection signatures. Confirm current versions and instructions against Atlassian’s advisory, because details can change as the situation develops.
Quick Recap
Response order
- List every Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye instance you run yourself, including forgotten test servers.
- Identify which ones are reachable from the internet and restrict them first.
- Apply the WAF or proxy rule where an upgrade can’t happen today, and test it.
- Upgrade each instance to the fixed version for its branch, or to a later fixed LTS release.
- Review logs, clean the web root and rotate any credentials that may have been exposed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
