Atlassian Data Center products: file-access flaw CVE-2026-21589 exploited; patches available
A critical Atlassian flaw (CVE-2026-21589) lets anyone on the internet read files in Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye Data Center. It is being exploited. Patch now, or take the server off the internet.
If your organisation runs any of these Data Center products, update to the fixed version listed by Atlassian and check access logs for signs of compromise. If you can't patch yet, take the server off the internet or apply Atlassian's WAF or Tomcat rewrite workaround. Atlassian Cloud users need to do nothing.
What’s happening
CVE-2026-21589 is a file-access flaw in eight self-hosted Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Atlassian says all versions are affected. Without logging in, an attacker can read specific files in the web application's folder, but only if they already know the exact file name and path. They cannot list folders. Atlassian rated it critical (CVSS 9.3); NVD scored it 7.5. Reports say leaked Crowd credentials could be used to create users and reach Jira admin access. Atlassian published fixed versions for every affected product on 5 October 2026 and says its Cloud products were already patched. Attacks began within hours of researchers publishing technical details. VulnCheck listed the flaw as exploited on 7 October, and CISA did so on 15 October. Atlassian says it cannot confirm whether a given Data Center instance was affected and advises customers to check their access logs. Versions past end of life may also be affected.
- What
- Flaw
- Affects
- Atlassian Data Center products (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye)
- Affected
- Bitbucket Data Center (all versions)
Confluence Data Center (all versions)
Jira Service Management Data Center (all versions)
Jira Software Data Center (all versions)
Bamboo Data Center (all versions)
Crowd Data Center (all versions)
Crucible (all versions)
Fisheye (all versions) - Fixed in
- Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1
Confluence Data Center 9.2.26, 10.2.19
Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12
Jira Software Data Center 9.12.40, 10.3.26, 11.3.12
Bamboo Data Center 10.2.24, 12.1.12
Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible 4.9.15
Fisheye 4.9.15 - Since
- 5 Oct 2026
- Closed
- 20 Oct 2026
Timeline
- Update
Atlassian's Confluence tracking ticket was last updated, still listing 9.2.26 and 10.2.19 as the fixed versions and the issue as fixed.
- CISA added
CISA added CVE-2026-21589 to its list of flaws being used in attacks (NVD score 7.5).
- Wider attacks
VulnCheck added CVE-2026-21589 to its known exploited vulnerabilities list after seeing activity aimed at Bamboo Data Center.
- Wider attacks
Previdian's honeypots began recording exploitation attempts within hours of watchTowr publishing its technical write-up. Help Net Security reported that watchTowr withheld its exploit code and released a vulnerability-check script; BleepingComputer's headline says a public proof of concept was released, so the sources differ on that point.
- Made publicFixed
Atlassian published its advisory for CVE-2026-21589, an arbitrary file access flaw rated critical (CVSS 9.3) in eight Data Center products, with fixed versions for each. It said Cloud products were already patched.
Sources
- CVE-2026-21589 Arbitrary File Access vulnerability impacts multiple productsAtlassian · 5 Oct 2026
- CONFSERVER-104488: CVE-2026-21589 in Confluence Data CenterAtlassian · 20 Oct 2026
- Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Help Net Security · 7 Oct 2026
- Critical Flaw in Multiple Atlassian Products Exploited in the WildInfosecurity Magazine · 7 Oct 2026