Recommended Free Tools
Inventory every affected self-managed Atlassian installation and upgrade each one to the applicable product-specific fixed release or later. Atlassian’s advisory, last modified October 5, 2026, lists the fixed versions below; check the live advisory before acting because release guidance may change.
Which Atlassian products and versions are affected?
Atlassian names eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. The advisory says versions before the listed fixes are affected. Its operational guidance should anchor your scope, including for installations on unsupported or end-of-life branches; do not assume an older branch is safe because it is no longer supported.
As an Amazon Associate I earn from qualifying purchases.
The vulnerability can allow an unauthenticated attacker to access particular files under the web application root when the attacker already knows each target file’s exact name and path. Atlassian says it does not allow directory listing or enumeration. This is not a claim of arbitrary access to every file on the host.
Atlassian rates the issue Critical, 9.3 under CVSS 4.0, as its internal severity assessment. Evaluate the risk in the context of your own environment and configuration.
#1 Best Overall
- Pass the Atlassian Managing Jira Projects for Data Center and Server Certification with updated flashcards packed with detailed content aligned to the latest exam blueprint. Cover all core topics without the overload found in lengthy study guides. Get 300+ Atlassian Managing Jira Projects for Data Center and Server Certification flashcards on 8-1/2″ x 11″ perforated card stock.
Which version should you install?
These are the fixed versions listed in Atlassian’s advisory as of October 5, 2026. Match the product and release branch you actually run; version numbers are not interchangeable across products. Upgrade to the applicable fixed release or a later suitable release. Atlassian recommends a fixed version or the latest version, and says to use the fixed LTS version or later where applicable.
| Product | Fixed versions listed by Atlassian |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
Use the product’s release notes and Atlassian’s download center to plan the upgrade. Confirm that the target release is appropriate for your branch and support requirements, then verify the installed version after deployment.
How to patch each installation
- Inventory every deployment. Include all instances of the eight named products, including test, staging, disaster-recovery, and unsupported-branch installations. Record each product name and exact installed version.
- Choose the matching fix. Compare each recorded product and version against its row in the table. Select the applicable fixed release or a later release appropriate to that installation; do not use a fix listed for another product.
- Plan and perform the upgrade. Follow the product’s release notes and vendor upgrade procedure. For a cluster, account for all nodes and any product-specific topology requirements.
- Verify the result. Check the deployed product version on every relevant instance or node and confirm it is at the chosen fixed release or later.
- Review access logs. Ask your security team to investigate for possible traversal attempts, whether or not the upgrade is complete.
What to do if you cannot patch immediately
Atlassian recommends removing an instance from the internet until it can be patched or mitigated, where possible. Restrict external network access to externally reachable instances even when they require authentication. Then apply a temporary control that matches the product and deployment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WAF or proxy filtering
For all affected products, Atlassian describes a WAF or proxy rule intended to block URLs with traversal patterns: .. immediately adjacent to /, , or ::, including encoded forms. The rule’s implementation depends on the WAF or proxy. Use the exact rule in Atlassian’s current advisory rather than recreating it from this description, and test it against relevant URL-encoded cases before relying on it.
Tomcat RewriteValve
Atlassian documents a RewriteValve mitigation for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd. Back up the instance and configuration files first. For each cluster node, shut it down, enable the RewriteValve in the relevant Tomcat configuration, and install or append Atlassian’s supplied rewrite.config in the product’s WEB-INF directory before restarting the node. Follow the advisory’s product-specific file paths and exact configuration instructions; do not infer a path from another product.
Bitbucket Data Center
For Bitbucket, back up the instance, edit <installation-directory>/app/WEB-INF/urlrewrite.xml, and place Atlassian’s supplied rule before the other rules. Apply the change to every cluster node and all Bitbucket mirrors or mirror-farm nodes, then restart Bitbucket Data Center. Use the vendor’s current rule and instructions, and test the change in your environment.
These controls are interim mitigations for installations that cannot yet be patched; they are not substitutes for upgrading to a fixed release. Keep external access restricted and complete the upgrade as soon as practical.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How to check for possible exploitation
Atlassian says it cannot confirm whether individual customer instances were affected and recommends that local security teams check logs for traversal patterns. Its advisory suggests URL-decoding logged requests up to two passes, then checking for .. adjacent to /, , or ::. It also describes searching raw log lines with its supplied regular expression. Use the exact expression and logging guidance from the advisory; the patterns alone do not establish that an attack succeeded.
Does this affect Atlassian Cloud?
Atlassian says affected Cloud products have been patched, it found no evidence of exploitation, and Cloud customers need take no action. That statement applies to the Cloud products covered by Atlassian’s advisory, not to self-managed Data Center installations.
For the live fixed-version list, exact mitigation rules, and product-specific configuration paths, consult Atlassian Support’s “CVE-2026-21589 – Arbitrary File Access Vulnerability impacts Multiple Products” advisory, last modified October 5, 2026. Atlassian’s Jira issue “Arbitrary File Access in Jira Data Center – JRASERVER-79546” also addresses Jira Data Center.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
