Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flaw

A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory.

The attacker must already know a file's exact name and path and cannot list what the directory holds.

Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and listed a fixed version for each product.

Atlassian describes 3 temporary blocking rules (mitigations), all of which block requests whose URL contains .. directly next to a forward slash, a backslash or ::, including URL-encoded forms.

Atlassian advises customers who cannot upgrade all at once to take the instance offline if possible; any instance reachable from the public internet, including one that requires a login, should be restricted from outside network access until it is upgraded or a temporary blocking rule is in place.

For Confluence, Jira Software, Jira Service Management, Bamboo and Crowd, a Tomcat RewriteValve rule is installed on each node, which must be shut down and restarted; for Bitbucket, a rule in urlrewrite.xml is applied to every node, mirror and mirror farm node, followed by a restart.

The flaw affects all versions of the 8 products before the fixed versions, which may include end-of-life versions, according to Atlassian, which recommends upgrading to a fixed long-term support (LTS) version or later.

Crucible and Fisheye have only the first mitigation option, a rule on a web application firewall or reverse proxy that blocks matching URLs, which is available for all 8 products.

For Crowd's 7.1 branch, the ticket's fix version field said 7.1.7, while a table in the same ticket showed 7.1.6, which the ticket also listed as an affected version.

The CVE record Atlassian filed listed 7.1.1 as the fixed Crowd version, which the Crowd 7.1 release notes date to November 27, 2025, more than 10 months before the flaw was disclosed.

For Bamboo, one field in the CVE record said 10.2.4, while the record's own description said 10.2.24.

The CVE record also listed the Server editions of these products, which the advisory did not mention, and marked every version of Bamboo Server, Bitbucket Server, Confluence Server and Crowd Server as affected with no fixed versions listed.

Atlassian tells customers to have security teams search access logs, either by URL-decoding each request line up to 2 times and looking for .. directly next to a forward slash, a backslash or ::, or by running Atlassian's block pattern over the raw log lines.

For Jira Software Server, the CVE record listed versions from 9.12.40 as unaffected, for Jira Service Management Server from 5.12.40, and for Crucible Server and Fisheye Server from 4.9.15; it did not say whether Server licenses can run those versions.

The advisory does not explain how to distinguish a failed attempt from a request that returned a file, or what else a customer who encounters such requests should do after upgrading.

Crowd has had no Server release since version 5.2 in September 2023, according to Atlassian's Crowd release notes, so none of the fixed Crowd versions are Server releases.

Atlassian listed fixed versions for the affected products as of October 6.

The mitigations "are limited and not a replacement for patching your instance."

Attackers have exploited this kind of flaw in an Atlassian product before; CVE-2021-26086 is a path traversal vulnerability in Jira.

Six of the 8 affected products have an in-application blocking rule that requires node restarts.

Four Server editions (Bamboo, Bitbucket, Confluence and Crowd Server) are marked affected in every version with no fixed version listed.

Atlassian said its affected cloud products have been patched and that its investigation has not found evidence of exploitation; Bitbucket Cloud is not affected.

"Atlassian cannot confirm if your instances have been affected by this vulnerability."