Recommended Free Tools
For a self-managed Atlassian product, identify the exact product and running version in the current security advisory, upgrade to a listed fixed version or later, and confirm that every instance and cluster node is running the patched release. Atlassian’s October 5, 2026 advisory for CVE-2026-21589 is a current worked example; its version table applies to that advisory and may change. Atlassian says affected Cloud products were patched and require no customer action for this issue.
First determine whether you need to act
For CVE-2026-21589, Atlassian’s October 5, 2026 advisory covers Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. It says all versions of those products are affected. Atlassian rates the vulnerability Critical, with a CVSS 4.0 score of 9.3. The issue could let an unauthenticated attacker access specific files within the web application root, but exploitation requires advance knowledge of the exact target file name and path; it does not allow directory listing or enumeration. Some configurations may expose sensitive files, increasing risk. See Atlassian’s CVE-2026-21589 advisory for the affected products, details, and current remediation guidance.
As an Amazon Associate I earn from qualifying purchases.
The responsibility differs by deployment type. Atlassian says affected Cloud products were patched and no Cloud customer action is required for this CVE. The advisory also reports no evidence of exploitation in its Cloud investigation; that is not a statement about every self-managed customer. Atlassian’s security FAQ and advisory information explain that Cloud vulnerability fixes are deployed by Atlassian, while monthly security bulletins cover Server and Data Center products. Do not apply the Data Center version table to Cloud.
Match the product and version to the advisory
Before planning a change, inventory deployment type, product, installed version, and every cluster node or mirror. Compare those details with the affected and fixed version tables in the exact advisory. For CVE-2026-21589, Atlassian lists these fixed versions as of October 5, 2026:
#1 Best Overall
| Product | Fixed versions named in the advisory |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
Atlassian recommends upgrading to a fixed LTS version or later, and says to patch each affected installation to a fixed version or the latest version. Treat the values above as specific to this advisory, not as a permanent compatibility or upgrade guide. Check the live advisory, release notes, supported upgrade path, and product support matrix immediately before scheduling the change.
Prepare a supported upgrade
Use the upgrade guide for the product and target release rather than assuming that one Atlassian product’s procedure applies to another. Review release and upgrade notes, check platform and app compatibility, run available pre-upgrade planning and health checks, and back up the instance and database. Atlassian recommends using the same installation method originally used. For example, its Jira 11 documentation says a binary installer is not supported for an installation originally installed manually from a zip archive; that Jira-specific restriction should not be generalized to other products. See the Jira upgrade documentation and Jira upgrade checklist for Jira guidance.
Rank #2
- Record the baseline: note the current version and deployment type for each product, plus each node and relevant Bitbucket mirror.
- Validate the route: confirm the target is fixed for the advisory and supported from the installed release; check compatibility and prerequisites in that product’s documentation.
- Protect recovery options: make and verify the backups required by your recovery plan before changing software.
- Schedule and communicate: plan the maintenance window or the product’s documented cluster procedure, and identify how you will check completion and service behavior.
Apply the fix to every affected installation
Upgrade each affected installation to a fixed version listed for that product or a later release that includes the fix. In a cluster, follow the product’s documented procedure and cover every node. Atlassian specifically says cluster mitigations must be applied to all nodes and calls out Bitbucket mirrors and mirror-farm nodes. Updating only the node used to start the change does not establish that the deployment is fully patched.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →If you cannot patch immediately, reduce exposure while arranging the upgrade. Atlassian recommends removing the instance from the internet if possible, including externally accessible instances that require authentication. Its advisory also gives product-specific temporary mitigations, including WAF or proxy filtering and application URL rewrite rules. Follow the exact rule and placement for your product in the live advisory; a loosely copied rule may not work as intended. These measures reduce exposure but are not equivalent to installing the fixed software.
Verify versions, cluster coverage, and service behavior
Check the version actually running on every instance and node against the advisory’s fixed-version table, then confirm the application is healthy. For Jira Data Center, Atlassian documents the path Administration > System > System info > Cluster nodes for checking whether upgraded nodes have rejoined. That navigation is Jira-specific; use the corresponding product documentation for other applications.
- Confirm every affected product instance reports a fixed version or later.
- Confirm all cluster nodes have rejoined and all relevant Bitbucket mirrors or mirror-farm nodes are covered.
- Check that nodes load as expected and run application-specific smoke tests or the service’s test suite.
- Keep the observed versions, node health, and test results with the change record.
Atlassian’s zero-downtime upgrade checklist includes verifying that all nodes rejoin, the application loads as expected, and smoke tests or a test suite pass. Version and health checks demonstrate the deployment’s current state; they do not establish whether an attacker accessed files before the fix.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep a change record and handle suspected compromise separately
Record the advisory identifier, old and new versions, which installations and nodes were covered, the maintenance window, health-check output, and test results. If you suspect unauthorized access, follow your incident-response procedures and preserve relevant evidence. A successful upgrade confirms neither that the system was never exploited nor that no earlier access occurred.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
