Atlassian file-access flaw requires a known path across eight products

Atlassian's October 5 advisory for CVE-2026-21589 describes unauthenticated access to specific files inside an affected product's web application root. An attacker must already know the target file's exact name and path. The issue does not provide directory listing. Atlassian rates it Critical, with a CVSS 4.0 score of 9.3.

The advisory names eight products: six Data Center lines, Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd, plus Crucible and Fisheye. All versions before the listed fixed versions are affected.

Fixed versions listed by Atlassian:

• Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
• Confluence Data Center: 9.2.26, 10.2.19
• Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
• Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
• Bamboo Data Center: 10.2.24, 12.1.12
• Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Crucible: 4.9.15
• Fisheye: 4.9.15

Cloud and self-managed exposure are different questions

Atlassian says affected Cloud products have been patched and its investigation found no evidence of exploitation in Cloud. It says Cloud customers do not need to take action. For the affected Data Center products, Atlassian says it cannot confirm whether customer instances were affected and directs operators to investigate. The Cloud finding is not an all-clear for self-managed installations, and the advisory does not establish confirmed Data Center victim counts.

Patch and review access logs

Identify the product and exact version on every instance, then update to one of Atlassian's listed fixes or a later version. If patching must wait, Atlassian recommends restricting external access and provides a WAF or proxy rule for all affected products, plus product-specific Tomcat RewriteValve guidance and a separate Bitbucket rewrite rule. Follow its current instructions for the product in use and test encoded path forms before relying on a mitigation.

For threat review, Atlassian recommends URL-decoding access-log requests up to two times and checking for .. adjacent to slash, backslash, or double-colon separators. It also recommends searching raw log lines with its rule. Those patterns can identify requests worth investigating; they do not by themselves confirm that a file was retrieved or that an instance was compromised.