CVE-2026-21589: critical pre-auth arbitrary file read in Atlassian Data Center and Server products, exploited in the wild
Published 26/10/2026 10:54
Timeline
3 events over 11 d
- 15/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 15/10/2026ExploitedCISA Known Exploited Vulnerabilities+11 d
- 26/10/2026 10:54Published on WatchtowerPro CISO
In short
CVE-2026-21589 lets an unauthenticated attacker read specific files in the web application root of several Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. CISA lists it as exploited in the wild (15/10/2026). Update to the fixed versions listed below as soon as possible, starting with internet-facing instances. Shodan estimates 107 internet-facing systems tagged with CVE-2026-21589 worldwide, 39 of them in the EU (26/10/2026).
Affected versions
- Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. Every version earlier than the fixed versions is affected.
- Atlassian Cloud was already patched, so cloud customers do not need to act.
- Jira, Confluence or Bitbucket instances linked to Crowd may store the Crowd application name and password in plain text in WEB-INF/classes/crowd.properties, which this flaw can read.
What to do now
- 1. Update to the fixed version for your product: Bitbucket Data Center 9.4.26, 10.2.8 or 10.5.1; Confluence Data Center 9.2.26 or 10.2.19; Jira Service Management Data Center 5.12.40, 10.3.26 or 11.3.12; Jira Software Data Center 9.12.40, 10.3.26 or 11.3.12; Bamboo Data Center 10.2.24 or 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Crucible 4.9.15; Fisheye 4.9.15 (or later). Atlassian recommends the fixed LTS version or later. Start with internet-facing instances.
- 2. If you cannot update immediately, take the instance off the public internet, or apply one of Atlassian's mitigations: a WAF/proxy rule using Atlassian's regular expression (all products); Tomcat RewriteValve with a rewrite.config in WEB-INF (Confluence, Jira Service Management, Jira, Bamboo, Crowd); or a blocking rule at the top of ./app/WEB-INF/urlrewrite.xml then restart (Bitbucket). Back up first. The exact snippets are in Atlassian's advisory and on CERT-EU's page. These interim measures reduce exposure and do not make a server safe; they do not replace patching.
- 3. Check access logs: decode each request line (up to twice) and look for '..' next to '/', '\' or '::', or search raw lines with Atlassian's regular expression. Atlassian cannot tell whether a given instance was hit.
- 4. If compromise is suspected, investigate the instance, review and rotate any credentials or secrets that may have been exposed, and contact the relevant cybersecurity authority. For instances linked to Crowd, rotate the Crowd application passwords first.
- 5. Do not run unofficial GitHub PoC tools, as they could be malicious.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Atlassian Confluence / Jira / Bitbucket, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Atlassian Multiple Products - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Vendor · You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) Research · Known Exploited Vulnerabilities Catalog Research