Atlassian Data Center (Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, Fisheye), unauthenticated arbitrary file access in the web application root, CVSS 4.0 9.3, no exploitation reported

CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)

Atlassian's advisory of 2026-10-05 says every version of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center, and of Crucible and Fisheye, is affected by CVE-2026-21589, an arbitrary file access flaw that lets an unauthenticated attacker access specific files within the web application root directory (Atlassian, 2026-10-05). The attacker needs the target file's exact name and path and cannot enumerate or list directory contents, and Atlassian adds that in some configurations sensitive files are present that increase the risk (Atlassian, 2026-10-05). Atlassian's public ticket for Confluence Data Center labels the weakness "Path Traversal (Arbitrary Read/Write)" (Atlassian, 2026-10-02), while the advisory's CVSS 4.0 vector (9.3, Critical: network, low complexity, no privileges, no user interaction) rates the confidentiality impact high and the integrity and availability impact none on the vulnerable system, with high confidentiality, integrity and availability impact on subsequent systems (Atlassian, 2026-10-05). Atlassian Cloud is already patched and Atlassian says its investigation found no evidence of exploitation (Atlassian, 2026-10-05); The Register reports that Atlassian emailed customers on Monday pointing to the advisory (The Register, 2026-10-06).

The fixed versions are Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1; Confluence Data Center 9.2.26 and 10.2.19; Jira Service Management Data Center 5.12.40, 10.3.26 and 11.3.12; Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12; Bamboo Data Center 10.2.24 and 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4; and Crucible and Fisheye 4.9.15 (Atlassian, 2026-10-05). Atlassian's Confluence ticket adds that versions past end of life may also be affected (Atlassian, 2026-10-02), and its Crowd ticket lists 7.1.6 as the fixed 7.1 build where the advisory lists 7.1.7 (Atlassian, 2026-10-02). Until a patch is applied, Atlassian says to remove the instance from the internet where possible, including instances that require user authentication, or to block at a web application firewall or proxy any URL that carries '..' directly next to a slash, backslash or '::' in plain or percent-encoded form; it also gives a Tomcat RewriteValve rule for Confluence, Jira Service Management, Jira Software, Bamboo and Crowd and a urlrewrite.xml rule for Bitbucket (Atlassian, 2026-10-05).