Check each installation’s product, deployment type, and version against Atlassian’s product-specific fixed releases. CVE-2026-21589 affects specified Jira and Confluence Data Center versions before those fixes; Atlassian says affected Cloud products have been patched and Cloud customers need take no action for this CVE. A version check shows whether software is exposed, not whether an attacker exploited it.
What CVE-2026-21589 affects
Atlassian describes CVE-2026-21589 as an unauthenticated arbitrary file access vulnerability in specified Data Center products. An attacker who knows the exact name and path of a target file can access specific files within the web application root. Atlassian says the flaw does not allow directory listing or enumeration. The risk can be greater if sensitive files are present.
As an Amazon Associate I earn from qualifying purchases.
Atlassian rates the issue Critical with a CVSS 4.0 score of 9.3 in its advisory; the vendor advises organizations to assess applicability in their own environments. See Atlassian’s security advisory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the product and version on every instance
- Inventory all deployments. Include every Jira Software Data Center, Jira Service Management Data Center, and Confluence Data Center instance, including cluster nodes and deployments outside the usual support window. Atlassian says versions before the listed fixes are affected; its Jira issue notes end-of-life versions may also be affected.
- Identify the exact product and deployment model. Do not treat Jira Software and Jira Service Management as the same maintenance branch, and do not apply a Jira threshold to Confluence. This advisory concerns Data Center products. Atlassian says affected Cloud products have been patched, with no Cloud customer action required for this issue. The advisory does not name Jira Server or Confluence Server; do not assume the Data Center finding applies to Server without separate vendor confirmation.
- Find the installed version. Check the product’s administration interface or deployment records. For a cluster, account for every node and instance rather than checking only the URL or a single server.
- Compare with the matching fixed release. Any version earlier than the applicable release in the table is affected. Upgrade to that release or a later release. If your branch or build does not map clearly to a threshold, confirm the correct upgrade path in Atlassian’s live advisory and release notes.
| Product and deployment | Fixed releases | Exposure rule |
|---|---|---|
| Jira Software Data Center | 9.12.40, 10.3.26, or 11.3.12 | Versions before the applicable fixed release are affected. |
| Jira Service Management Data Center | 5.12.40, 10.3.26, or 11.3.12 | Versions before the applicable fixed release are affected. |
| Confluence Data Center | 9.2.26 or 10.2.19 | Versions before the applicable fixed release are affected. |
| Atlassian Cloud products | Atlassian says affected products have been patched. | No customer action is required for this CVE, according to Atlassian. |
These thresholds are from Atlassian’s security advisory; the Jira-specific thresholds are also corroborated by its Jira issue page. Check those live sources for current version guidance before changing production systems.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If an instance is affected and cannot be patched immediately
Upgrade to a fixed release as soon as practicable. If patching must wait, reduce the instance’s exposure while preparing the upgrade:
- Remove the affected instance from internet access if possible.
- Use Atlassian’s WAF or proxy filtering guidance to block path-traversal patterns, including URL-encoded forms. Test that the rule blocks the documented patterns without disrupting legitimate traffic.
- For Jira and Confluence, Atlassian also documents a Tomcat RewriteValve mitigation using a
rewrite.configfile on each Data Center node. Back up configuration, follow the product-specific paths and per-node instructions, and restart as directed.
These are temporary mitigations, not substitutes for installing a fixed release. Follow the steps and current configuration details in Atlassian’s advisory.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check separately for signs of possible exploitation
A version comparison identifies affected software; it cannot establish whether the vulnerability was used. Atlassian says it cannot confirm whether an individual instance has been affected. If an instance was exposed while vulnerable, involve your organization’s security or incident-response team and review the relevant access logs.
Atlassian recommends decoding each access-log request line up to two times and searching for .. immediately adjacent to /, , or ::. Its advisory also provides a regular expression for searching raw requests. Use the vendor’s exact detection guidance and have the security team assess any matches in context; a match or lack of one alone does not establish the full impact. See Atlassian’s advisory for the regex and details.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
