Small Town Sysadmin
Free CJIS checklist

Networks

Security alert

Patch self-hosted Jira, Confluence, and Bitbucket: an unauthenticated file-access flaw is now on CISA's exploited list

CVE-2026-21589 affects eight Atlassian Data Center products. CISA listed it as exploited on October 15. Here's who is affected, which versions fix it, and what to do if you can't patch yet.

If your office or agency runs Jira, Confluence, Bitbucket, Bamboo, or Crowd on its own servers, check the version today. On October 15, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using it against real systems. CISA’s due date for federal agencies was October 18.

Atlassian’s cloud products are not affected by anything you need to do. The advisory says Atlassian already patched them and no cloud customer action is required. This is a problem for self-hosted Data Center installs.

What it is

An attacker who does not need to sign in can read certain files inside the web application’s root folder. Atlassian rates it Critical, 9.3 on the CVSS 4.0 scale. According to Atlassian, the attacker has to know the exact file name and path, and the flaw can’t be used to list folders. Treat an exposed, unpatched server as possibly read.

CISA’s entry marks it as requiring forensic triage under its Binding Operational Directive 26-04, and lists ransomware use as unknown.

Who is affected

Atlassian lists these Data Center products as affected in every version before the fixed releases below:

  • Bitbucket
  • Confluence
  • Jira Service Management
  • Jira Software
  • Bamboo
  • Crowd
  • Crucible and Fisheye

Fixed versions

Product Fixed in
Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1
Confluence Data Center 9.2.26, 10.2.19
Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12
Jira Software Data Center 9.12.40, 10.3.26, 11.3.12
Bamboo Data Center 10.2.24, 12.1.12
Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible 4.9.15
Fisheye 4.9.15

Pick the fixed release that matches the line you are on. Atlassian says critical fixes are backported to supported maintenance releases, recommends the fixed long-term-support version or later, and no longer ships binary patches, so this means a full upgrade.

Check whether you’re exposed

  1. List what you run. Look for Atlassian products installed on servers you manage, including old ones someone set up years ago and forgot.
  2. Check the version in each product’s admin area, and compare it with the table above.
  3. Find out who can reach it. A server open to the internet is the top priority. One reachable only on the office network or over a VPN is lower risk, but patch it too.

What to do

  1. Take a backup and a server snapshot, then upgrade to a fixed version.
  2. If you can’t upgrade today, cut the exposure. Atlassian’s first advice is to take the instance off the internet where you can. Put it behind your VPN or a firewall rule limited to your own addresses.
  3. Apply Atlassian’s temporary mitigation if patching must wait. The advisory gives three options: a web application firewall or reverse proxy rule that blocks path-traversal patterns, a Tomcat rewrite rule for Confluence, Jira, Bamboo, and Crowd, or a URL rewrite rule for Bitbucket. Apply it on every node, including Bitbucket mirrors. Follow Atlassian’s exact steps rather than improvising.
  4. Review your access logs for path-traversal patterns, as Atlassian recommends. Atlassian says it can’t tell whether any individual customer instance was affected, so the check is yours to make.
  5. If anything looks wrong, treat the server as breached: change secrets stored in it, such as API tokens, service account passwords, and anything pasted into pages or tickets, and follow what to do in the first hour.

Atlassian’s advisory said on October 5 that it had found no evidence of exploitation. CISA’s October 15 listing supersedes that for planning purposes: assume attacks are happening. Details are as of October 23, 2026.

For office managers

If your IT person or provider runs Jira, Confluence, or Bitbucket in-house, ask them to confirm it has been updated to a fixed version and is not open to the whole internet. You don’t need to do anything else.

Sources

All articles