What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Patching” Jira or Confluence can mean two different jobs. One is installing a specific security fix from an Atlassian advisory. The other is moving to a newer supported release, which is how most fixes reach you in practice. The safe procedure depends on four things: the product, the exact installed version, the deployment type (Cloud, Data Center, or legacy Server) and your topology (single node or cluster). This guide gives the workflow that holds across all of them: identify what you run, choose a supported target, prepare a recoverable change, apply the update with the method for your deployment, and prove afterward that the fixed version is actually running.
Atlassian’s detailed upgrade instructions are mostly written for Data Center, so that is where this guide goes deepest. It does not replace the upgrade documentation for your exact product and version. That documentation is the authority for commands, node order, downtime and rollback.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Jira Administrator Ceramic Mug, Black/White, 15oz | $18.49 | Buy on Amazon |
| 2 |
|
Ultimate Salesforce Data Cloud for Customer Experience: Explore, Implement, and Elevate B2C... | $24.95 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Step 1: Identify exactly what you are patching
Before you read an advisory or schedule a window, write down the following. Every later decision depends on it.
- Product: Jira (Software, Service Management, Work Management or core) or Confluence.
- Deployment type: Cloud, Data Center, or a legacy Server installation.
- Exact installed version (for example a full 9.x or 10.x number, not just “Jira 9”).
- Topology: single node or cluster, and how many nodes.
- Dependencies: database type and version, operating system, Java runtime, reverse proxy, and every installed app (plugin).
- Support status: whether your release line is still within its support window.
You can read the running version from inside the product. In Jira, look under the administration System section’s system information. In Confluence, look in General Configuration for system information. Menu labels shift between versions, so confirm against your own instance.
#1 Best Overall
- A great birthday, Christmas or promotion gift for a Jira Administrator team member, co-worker, employee, friend or family member.
- Put a smile on a member of your IT departments face with this awesome item today.
- Dishwasher and microwave-safe for everyday convenience and easy cleanup
- Features glossy finish with accent colors on interior, handle, and rim of two-tone designs
- Perfect for morning coffee, tea, or hot cocoa at home or the office
What this means by deployment type
| Deployment | Who applies the patch | What you do |
|---|---|---|
| Cloud | Atlassian runs and updates the service | Read the advisory to see whether any action is needed on your side. Check your apps and any self-managed connectors. The Data Center procedure below does not apply. |
| Data Center | You | Follow the full workflow in this guide, using the topology-specific upgrade documentation (clustered or non-clustered). |
| Server (legacy) | You, if it is still running | Atlassian ended Server support in February 2024, so a fix may not be published for your version. Treat a migration to a supported deployment as the real remediation. Check the advisory and the support policy for your version. |
Atlassian’s “Security Patches Troubleshooting” page is explicitly marked as Data Center-only, so do not apply it to Cloud.
Step 2: Choose a supported target version
If you are responding to a security advisory
Start with the current Atlassian security advisory for the vulnerability. Use its fixed-version table for the branch you run. Advisories usually list a fixed release for each supported line, so find your line and choose that fix or anything newer. Do not reuse a fixed-version list from an old advisory (for example, a past Confluence CVE) as guidance for a different vulnerability. Those lists are specific to one issue at one point in time.
If you are doing routine maintenance
Use the product’s release notes and the upgrade matrix. Jira’s release notes list the active release lines. They say bug-fix releases include security fixes and regular bug fixes, and that these are generally scheduled monthly, a cadence that can change. Atlassian’s End of Support Policy recommends upgrading to the latest feature or LTS release, and says a supported release gets two years of support after its initial feature or LTS release.
The policy illustrates this with Jira Software Data Center 10.4.0, released January 22, 2025 and supported until January 22, 2027. That is a policy example, not a recommendation to target 10.4.0. Check the current policy and release notes for dates that apply to your line.
If your installed version is near or past the end of its support window, a security fix may only exist on a newer line. In that case the job is an upgrade, and you should budget accordingly.
Step 3: Run compatibility and health checks first
Atlassian’s Confluence upgrade guide puts it plainly: check the Confluence Upgrade Matrix, take a full backup, and test your upgrade in a non-production environment before upgrading production. The same discipline applies to Jira. Before scheduling, work through this list:
- Upgrade path. Confirm in the upgrade matrix and upgrade notes that your source version can move directly to the target. Some jumps need an intermediate step or have required changes in between.
- Platform requirements. Check that the target release supports your database, OS and Java version. A platform change may need to happen before, or separately from, the application upgrade.
- Apps. Verify each installed app has a version compatible with the target. Disable or plan to update the ones that do not.
- Built-in checks. Confluence includes a “Plan your upgrade” feature in the admin console that Atlassian recommends running. Also run the product’s health checks and resolve what they flag.
- Upgrade notes. Read the notes for every release between your version and the target, not just the last one.
Step 4: Make the change recoverable
A patch you cannot roll back is a gamble. Atlassian advises regular, testable backups. Before the maintenance window:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Back up the database using your database vendor’s supported method, and note the exact time of the backup.
- Back up the application installation directory and the home directory. On a cluster, also back up the shared home.
- Copy configuration you have customised (for example server and startup configuration files) so you can compare them after the upgrade.
- Restore the backup into a separate environment to prove it works. An untested backup is not a rollback plan.
- Rehearse the whole upgrade in a non-production copy of your instance, with your real data and apps if you can. Note how long it takes, since that sets the length of your window.
Two backup traps
- Do not use an XML backup to upgrade Confluence. Atlassian says to use the supported upgrade process instead.
- XML backups can be inconsistent. Atlassian’s Data Center checklist warns that an XML database backup may be inconsistent if the database changes while it is running. Use database-level backups taken in a consistent state.
Step 5: Apply the update
Use the upgrade page for your exact product, version and topology. The outline below shows how the paths differ. It is not a substitute for those pages.
Confluence Data Center
Atlassian’s guide separates two cases:
- Non-clustered (single node): there is one installation to stop, upgrade and restart, so plan for downtime.
- Clustered: the standard upgrade follows a cluster-specific procedure. It differs from the single-node one in how nodes are stopped, upgraded and brought back, so do not improvise node order.
Can you upgrade Confluence without downtime? Only in a narrow case. Atlassian documents a separate rolling-upgrade path for compatible bug-fix updates on a cluster. That option does not cover every upgrade. Check that your source and target versions are eligible under the rolling-upgrade documentation, and plan a normal window for anything else.
Jira Data Center
Use the current upgrade documentation for your Jira product and version, together with the release notes for the target. Be wary of old articles. A Jira 7.2-era upgrade guide still appears in searches, but it is legacy material and is not a current runbook.
During the window
- Announce the window and block changes to the instance. On a cluster, keep nodes on a consistent version once the procedure says to.
- Keep the installer or package you tested, rather than downloading a fresh one on the day.
- Watch the logs during first startup. Database migrations and app loading happen here, and failures are easiest to read as they occur.
Step 6: Verify the fix
Atlassian’s sources document the pre-upgrade checks and the release notes well. They do not publish one post-upgrade checklist that covers every version and deployment type. The list below is a practical checklist, not a quoted Atlassian procedure. Cross-check it against the documentation for your release.
1. Confirm the version on every node
Check the version reported by the application, not the one you meant to install. Look at system information in the admin console, and on a cluster confirm every node, since a node that missed the upgrade or a stale cached package can leave you partly patched. If you are fixing a specific vulnerability, compare the running version with the fixed version listed for your branch in the advisory. “Equal or newer on the same line” is what you are looking for. A newer version on a different line may not contain the fix.
2. Run health checks and read the logs
- Run the product’s built-in health checks and clear any new warnings.
- Review the application logs from the first startup for migration errors, plugin or app failures, database connection problems and licence warnings.
- For Data Center, use the Security Patches Troubleshooting page if the advisory or the upgrade raises patch-related problems.
3. Test real workflows
- Sign in through your normal authentication method (SSO, LDAP or local).
- Jira: create, transition and search issues, and check a board and a dashboard. Confluence: open, edit and publish a page, and run a search.
- Test attachments, email notifications and integrations that matter (for example Jira–Confluence links, CI tools, chat apps).
- Confirm each business-critical app loads and works. Re-enable any you disabled for the upgrade once you have confirmed it is compatible.
4. Check the cluster
On Data Center, confirm all nodes are listed and healthy, that they show the same version, and that the load balancer is sending traffic to them. Look for nodes that dropped out after the restart.
Quick Recap
5. Close out the security item
- Record the before and after versions, the advisory identifier and the date.
- If the advisory describes a mitigation, detection step or workaround, follow it. Where there is a credible chance the instance was exposed before you patched, apply any vendor guidance on checking for compromise. Patching closes the hole but does not undo earlier access.
- Keep the pre-upgrade backup until you are confident the new version is stable, then expire it according to your retention policy.
If something fails
- Startup fails or migration errors appear: stop, read the log, and check the upgrade notes and Atlassian’s knowledge base for the exact message. Do not repeatedly restart a node that is part-way through a database migration.
- An app breaks the instance: disable the app, or the apps recently updated, and retest. Then update or replace it with a version for the target release.
- The fix cannot be made quickly: restore the database and file backups together, not one without the other, then return to the rehearsal environment and find the cause before retrying.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
