Live › vulnerability › CVE-2026-21589
Go to dashboardPre-auth arbitrary file read in eight self-hosted Atlassian products (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye Data Center). Flaw is in shared web-resource handling: '::' is decoded to '/', so '..::' traversal reaches files under WEB-INF (e.g. web.xml) without login. Needs exact file path; no directory listing. File disclosure, not RCE, but exposed config can hold credentials. Exploited in the wild after watchTowr's public write-up and PoC; in CISA KEV. Atlassian Cloud already patched.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Atlassian Multiple Products | vendor | – | – |
| Bitbucket Data Center | vendor | < 9.4.26; >= 10.0, < 10.2.8; >= 10.3, < 10.5.1 | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | vendor | < 9.2.26; >= 10.0, < 10.2.19 | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | vendor |
| < 5.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12 |
| 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | vendor | < 9.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12 | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | vendor | < 10.2.24; >= 12.0, < 12.1.12 | 10.2.24, 12.1.12 |
| Crowd Data Center | vendor | < 6.3.7; 7.0.x < 7.0.3; 7.1.x < 7.1.7; 7.2.x < 7.2.4 | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | vendor | < 4.9.15 | 4.9.15 |
| Fisheye | vendor | < 4.9.15 | 4.9.15 |
| atlassian bitbucket data center | vendor | >= 7.17.0, < 9.4.26 | 9.4.26 |
| atlassian bitbucket data center | vendor | >= 9.5.0, < 10.2.8 | 10.2.8 |
| atlassian bitbucket data center | vendor | >= 10.3.0, < 10.5.1 | 10.5.1 |
| atlassian bitbucket server | vendor | >= 4.6.0, <= 8.14.6 | – |
| atlassian confluence data center | vendor | >= 5.10.0, < 9.2.26 | 9.2.26 |
| atlassian confluence data center | vendor | >= 9.3.0, < 10.2.19 | 10.2.19 |
| atlassian crowd | vendor | >= 2.11.0, < 6.3.7 | 6.3.7 |
| atlassian crowd | vendor | >= 7.0.0, < 7.0.3 | 7.0.3 |
| atlassian crowd | vendor | >= 7.1.0, < 7.1.7 | 7.1.7 |
| atlassian crowd | vendor | >= 7.2.0, < 7.2.4 | 7.2.4 |
| atlassian jira data center | vendor | >= 7.1.0, < 9.12.40 | 9.12.40 |
| atlassian jira data center | vendor | >= 9.13.0, < 10.3.26 | 10.3.26 |
| atlassian jira data center | vendor | >= 10.4.0, < 11.3.12 | 11.3.12 |
| atlassian jira service desk | vendor | >= 3.1.0, <= 4.13.27 | – |
| atlassian jira service management | vendor | >= 4.14.0, < 5.12.40 | 5.12.40 |
| atlassian jira service management | vendor | >= 5.13.0, < 10.3.26 | 10.3.26 |
| atlassian jira service management | vendor | >= 10.4.0, < 11.3.12 | 11.3.12 |
| atlassian bamboo | vendor | >= 7.0.1, < 10.2.24 | 10.2.24 |
| atlassian bamboo | vendor | >= 11.0.0, < 12.1.12 | 12.1.12 |
| atlassian crucible | vendor | < 4.9.15 | 4.9.15 |
| atlassian fisheye | vendor | < 4.9.15 | 4.9.15 |
.. next to '/, ` or :: (URL-decode up to two passes), or run Atlassian`s regex on raw lines..:: and WEB-INF4.9.15; Fisheye 4.9.15.. adjacent to / \ or :: (also URL-encoded), or use Tomcat RewriteValve rules (Confluence/Jira/JSM/Bamboo/Crowd) or a urlrewrite.xml rule (Bitbucket), on every node including Bitbucket mirrorsWhat vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai
October 07, 2026 by Akamai Security Intelligence Group
On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. CVE-2026-21589 carries a maximum CVSS v4.0 score of 9.3. The vulnerability stems from a path traversal flaw.
An unauthenticated remote attacker could exploit this vulnerability to read specific files within the web application root directory of affected Atlassian products. Although the vulnerability does not allow directory enumeration, attackers with knowledge of exact filenames could access sensitive information, such as configuration files containing plain-text credentials.
The patch is available immediately, and Atlassian has urged self-hosted users to upgrade to fixed releases as soon as possible. Cloud users are not affected as Atlassian has already applied fixes.
Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts.
The most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules as recommended by Atlassian is critical to block path traversal and directory traversal attempts.
The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.
This page as .md · .json · in your agent: get_signal("CVE-2026-21589")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.