{"id":"CVE-2026-21589","kind":"vulnerability","aliases":["CVE-2026-21589"],"related":[],"title":"This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira…","description":"CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai\n\n# CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products \n\n October 07, 2026 by Akamai Security Intelligence Group \n\nOn October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. CVE-2026-21589 carries a maximum CVSS v4.0 score of 9.3. The vulnerability stems from a path traversal flaw.\n\nAn unauthenticated remote attacker could exploit this vulnerability to read specific files within the web application root directory of affected Atlassian products. Although the vulnerability does not allow directory enumeration, attackers with knowledge of exact filenames could access sensitive information, such as configuration files containing plain-text credentials.\n\nThe patch is available immediately, and Atlassian has urged self-hosted users to upgrade to fixed releases as soon as possible. Cloud users are not affected as Atlassian has already applied fixes.\n\n## Mitigation with Akamai App & API Protector \n\nAkamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts. \n\n- Adaptive Security Engine: 3000990 v1 — Atlassian Pre-Auth Arbitrary File Read Detected (CVE-2026-21589)\n\nThe most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules as recommended by Atlassian is critical to block path traversal and directory traversal attempts.\n\n### Stay tuned \n\nThe Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.","summary":"Pre-auth arbitrary file read in eight self-hosted Atlassian products (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye Data Center). Flaw is in shared web-resource handling: '::' is decoded to '/', so '..::' traversal reaches files under WEB-INF (e.g. web.xml) without login. Needs exact file path; no directory listing. File disclosure, not RCE, but exposed config can hold credentials. Exploited in the wild after watchTowr's public write-up and PoC; in CISA KEV. Atlassian Cloud already patched.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-10-15T00:00:00+00:00","products":[{"name":"Atlassian Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Bitbucket Data Center","fixed":["9.4.26","10.2.8","10.5.1"],"affected":"< 9.4.26; >= 10.0, < 10.2.8; >= 10.3, < 10.5.1","ecosystem":"vendor"},{"name":"Confluence Data Center","fixed":["9.2.26","10.2.19"],"affected":"< 9.2.26; >= 10.0, < 10.2.19","ecosystem":"vendor"},{"name":"Jira Service Management Data Center","fixed":["5.12.40","10.3.26","11.3.12"],"affected":"< 5.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12","ecosystem":"vendor"},{"name":"Jira Software Data Center","fixed":["9.12.40","10.3.26","11.3.12"],"affected":"< 9.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12","ecosystem":"vendor"},{"name":"Bamboo Data Center","fixed":["10.2.24","12.1.12"],"affected":"< 10.2.24; >= 12.0, < 12.1.12","ecosystem":"vendor"},{"name":"Crowd Data Center","fixed":["6.3.7","7.0.3","7.1.7","7.2.4"],"affected":"< 6.3.7; 7.0.x < 7.0.3; 7.1.x < 7.1.7; 7.2.x < 7.2.4","ecosystem":"vendor"},{"name":"Crucible","fixed":["4.9.15"],"affected":"< 4.9.15","ecosystem":"vendor"},{"name":"Fisheye","fixed":["4.9.15"],"affected":"< 4.9.15","ecosystem":"vendor"},{"name":"atlassian bitbucket data center","fixed":["9.4.26"],"affected":">= 7.17.0, < 9.4.26","ecosystem":"vendor"},{"name":"atlassian bitbucket data center","fixed":["10.2.8"],"affected":">= 9.5.0, < 10.2.8","ecosystem":"vendor"},{"name":"atlassian bitbucket data center","fixed":["10.5.1"],"affected":">= 10.3.0, < 10.5.1","ecosystem":"vendor"},{"name":"atlassian bitbucket server","fixed":[],"affected":">= 4.6.0, <= 8.14.6","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["9.2.26"],"affected":">= 5.10.0, < 9.2.26","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["10.2.19"],"affected":">= 9.3.0, < 10.2.19","ecosystem":"vendor"},{"name":"atlassian crowd","fixed":["6.3.7"],"affected":">= 2.11.0, < 6.3.7","ecosystem":"vendor"},{"name":"atlassian crowd","fixed":["7.0.3"],"affected":">= 7.0.0, < 7.0.3","ecosystem":"vendor"},{"name":"atlassian crowd","fixed":["7.1.7"],"affected":">= 7.1.0, < 7.1.7","ecosystem":"vendor"},{"name":"atlassian crowd","fixed":["7.2.4"],"affected":">= 7.2.0, < 7.2.4","ecosystem":"vendor"},{"name":"atlassian jira data center","fixed":["9.12.40"],"affected":">= 7.1.0, < 9.12.40","ecosystem":"vendor"},{"name":"atlassian jira data center","fixed":["10.3.26"],"affected":">= 9.13.0, < 10.3.26","ecosystem":"vendor"},{"name":"atlassian jira data center","fixed":["11.3.12"],"affected":">= 10.4.0, < 11.3.12","ecosystem":"vendor"},{"name":"atlassian jira service desk","fixed":[],"affected":">= 3.1.0, <= 4.13.27","ecosystem":"vendor"},{"name":"atlassian jira service management","fixed":["5.12.40"],"affected":">= 4.14.0, < 5.12.40","ecosystem":"vendor"},{"name":"atlassian jira service management","fixed":["10.3.26"],"affected":">= 5.13.0, < 10.3.26","ecosystem":"vendor"},{"name":"atlassian jira service management","fixed":["11.3.12"],"affected":">= 10.4.0, < 11.3.12","ecosystem":"vendor"},{"name":"atlassian bamboo","fixed":["10.2.24"],"affected":">= 7.0.1, < 10.2.24","ecosystem":"vendor"},{"name":"atlassian bamboo","fixed":["12.1.12"],"affected":">= 11.0.0, < 12.1.12","ecosystem":"vendor"},{"name":"atlassian crucible","fixed":["4.9.15"],"affected":"< 4.9.15","ecosystem":"vendor"},{"name":"atlassian fisheye","fixed":["4.9.15"],"affected":"< 4.9.15","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["akamai","atlassian","bamboo","bitbucket","cloudflare","confluence","crowd","crucible","data-center","exploited","fisheye","jira","lab-disclosure","path-traversal","poc-public","pre-auth","self-hosted","vendor"],"not_affected_if":["atlassian-cloud","non-data-center-deployment"],"how_to_check":"Check your product version against the fixed list. Search access logs for '..' next to '/', '\\' or '::' (URL-decode up to two passes), or run Atlassian's regex on raw lines. Look for hits on /download/resources/... containing '..::' and WEB-INF. Treat any WEB-INF/config secrets (e.g. DB or Crowd credentials) on hit instances as exposed and rotate them. watchTowr's detection script (-H host) tests Jira, Confluence, Bitbucket.","fix":"Upgrade: Bitbucket DC 9.4.26/10.2.8/10.5.1; Confluence DC 9.2.26/10.2.19; JSM DC 5.12.40/10.3.26/11.3.12; Jira Software DC 9.12.40/10.3.26/11.3.12; Bamboo DC 10.2.24/12.1.12; Crowd DC 6.3.7/7.0.3/7.1.7/7.2.4; Crucible 4.9.15; Fisheye 4.9.15. If you cannot patch: take the instance off the internet, and block requests with a WAF/proxy regex for '..' adjacent to / \\ or :: (also URL-encoded), or use Tomcat RewriteValve rules (Confluence/Jira/JSM/Bamboo/Crowd) or a urlrewrite.xml rule (Bitbucket), on every node including Bitbucket mirrors. Exact rules are in the Atlassian advisory.","status":"resolved","published_at":"2026-10-05T22:16:58+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:49:58+00:00","updated_at":"2026-10-24T18:43:45+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-23T19:49:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Atlassian vendor mitigation or patch for the affected Data Center product, per the vendor advisory; the sources do not name the fixed versions.\nIf no mitigation exists, CISA says to discontinue use of the product.","summary":"Several Atlassian Data Center products (Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, Fisheye) expose specific files in the web application root to anyone without logging in. An unauthenticated attacker can read those files, and CISA reports this vulnerability is being exploited in the wild.","category":"vendor","who_cares":["self-hosted","data-center","confluence","jira","bitbucket","bamboo"],"confidence":0.7,"analyst_note":"Find the Atlassian security advisory for CVE-2026-21589 to get affected and fixed version ranges and the specific files exposed and mitigation steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["atlassian-cloud","non-data-center-deployment"],"severity_if_unknown":"high"},"cost_usd":0.000418,"input_tokens":2324,"output_tokens":371,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Atlassian security advisory for CVE-2026-21589 to get affected and fixed version ranges and the specific files exposed and mitigation steps.","search":"'-2026':19A,22A,234C,246C,295C,437C '-21589':20A,23A,235C,247C,296C,438C '07':257C '2026':258C,267C '3000990':426C '5':266C '9.3':304C 'access':350C 'across':281C 'adapt':423C 'address':274C,415C 'advisori':272C 'affect':332C,388C 'akamai':117B,244C,260C,397C,401C,480C,517C 'allow':340C 'alreadi':231B,392C 'although':335C 'api':399C,403C 'app':398C,402C 'appli':393C,458C 'applic':328C,448C,460C 'arbitrari':150B,237C,249C,277C,432C 'atlassian':24A,50A,54A,58A,62A,65A,69A,73A,75A,77A,79A,81A,85A,89A,93A,97A,101A,105A,109A,111A,113A,115A,118B,158B,229B,242C,254C,268C,283C,333C,368C,390C,428C,466C 'attack':316C,343C 'attempt':422C,476C 'auth':142B,149B,431C 'avail':365C 'bamboo':42A,110A,112A,119B,167B,293C 'bitbucket':6A,27A,51A,55A,59A,63A,120B,160B,288C 'block':470C 'break':513C 'cannot':455C 'carri':297C 'center':8A,11A,16A,29A,32A,37A,41A,44A,47A,53A,57A,61A,68A,72A,84A,88A,92A,127B,172B,285C 'check':521C 'cisa':227B 'cloud':230B,384C 'cloudflar':121B 'communiti':505C 'config':209B 'configur':355C 'confluenc':9A,122B,161B,289C 'confluence':30A,66A,70A 'contain':357C 'continu':443C,485C 'could':317C,349C 'creat':491C 'credenti':212B,361C 'critic':236C,248C,276C,468C 'crowd':45A,74A,76A,78A,80A,123B,168B 'crucibl':124B,169B 'crucible':48A,114A 'custom':405C,501C 'cve':18A,21A,233C,245C,294C,417C,436C 'cvss':300C 'data':7A,10A,15A,28A,31A,36A,40A,43A,46A,52A,56A,60A,67A,71A,83A,87A,91A,126B,171B,284C 'data-cent':125B 'decod':182B 'defens':442C 'desk':96A 'detect':435C 'directori':201B,330C,341C,474C 'disclosur':133B,204B 'e.g':192B 'effect':441C 'eight':154B 'engin':425C 'enumer':342C 'exact':197B,347C 'exploit':128B,213B,318C,421C 'expos':208B 'file':151B,187B,198B,203B,238C,250C,278C,324C,356C,433C 'filenam':348C 'firewal':461C 'fishey':129B,170B 'fisheye':49A,116A 'fix':378C,394C 'flaw':173B,312C 'follow':528C 'group':263C,483C,520C 'handl':180B 'hold':211B 'home':525C 'host':145B,157B,373C 'immedi':366C,457C 'includ':287C 'inf':191B 'inform':352C 'intellig':262C,482C,519C 'jira':12A,17A,33A,38A,82A,86A,90A,94A,98A,102A,106A,130B,162B,164B,290C 'keep':509C 'kev':228B 'knowledg':345C 'lab':132B 'lab-disclosur':131B 'larg':507C 'list':202B 'login':195B 'manag':14A,166B 'management':35A,100A,104A,108A 'maximum':299C 'media':532C 'mitig':395C,492C 'monitor':419C,487C 'multipl':282C 'multiple':25A 'need':196B 'news':514C 'octob':256C,265C 'organ':453C 'page':526C 'patch':232B,363C,451C,456C 'path':135B,199B,310C,471C 'path-travers':134B 'plain':359C 'plain-text':358C 'poc':138B,225B 'poc-publ':137B 'possibl':383C 'pre':141B,148B,430C 'pre-auth':140B,147B,429C 'product':159B,243C,255C,286C,334C 'products':26A 'prompt':447C 'protect':407C 'protector':400C,404C 'public':139B,220B 'rce':206B 'reach':186B 'read':152B,239C,251C,279C,322C,434C 'recommend':464C 'releas':269C,379C,411C 'remot':315C 'report':488C 'research':524C 'resourc':179B 'root':329C 'rule':462C 'score':302C 'secur':261C,271C,412C,424C,481C,504C,518C 'self':144B,156B,372C 'self-host':143B,155B,371C 'sensit':351C 'server':64A 'servic':13A,165B 'service':34A,95A,99A,103A,107A 'share':176B 'social':531C 'softwar':163B,291C 'software':39A 'soon':381C 'specif':323C 'stay':477C 'stem':307C 'text':360C 'threat':494C 'travers':136B,185B,311C,472C,475C 'tune':478C 'unauthent':314C 'updat':413C 'upgrad':376C 'urg':370C 'us':529C 'user':374C,385C 'v1':427C 'v4.0':301C 'vendor':146B,450C 'vulner':4A,240C,252C,280C,306C,320C,337C 'watchtowr':218B 'web':178B,190B,327C,459C 'web-inf':189B 'web-resourc':177B 'web.xml':193B 'wild':216B 'within':325C 'without':194B 'write':222B 'write-up':221B","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":null,"covers":"Akamai App & API Protector customers, via Adaptive Security Engine rule 3000990 v1 (Atlassian Pre-Auth Arbitrary File Read Detected)","limits":"none stated","source":"https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability","vendor":"Akamai","seen_at":"2026-10-24T18:43:25Z","confidence":0.8,"source_title":"CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai","customer_action":"apply vendor patches promptly; the rule detects exploitation attempts and is not described as a complete fix"},{"kind":"waf-rule","since":"2026-10-12","covers":"Requests matching the Atlassian arbitrary file access pattern, via Cloudflare Managed Ruleset rule Atlassian - Arbitrary File Access - CVE:CVE-2026-21589","limits":"Only traffic proxied through Cloudflare; the rule covers only the detected pattern","source":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:23Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-10-12 · Changelog","customer_action":"none stated"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-05T22:16:58+00:00","kev":{"dateAdded":"2026-10-15","dueDate":"2026-10-18","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@atlassian.com","poc_count":2,"sources":[{"source":"kev","external_id":"CVE-2026-21589","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589","severity":null,"published_at":"2026-10-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-21589:104","url":null,"severity":null,"published_at":"2026-10-23T21:34:06+00:00","modified_at":"2026-10-23T21:34:06+00:00","first_seen_at":"2026-10-23T21:34:06+00:00","fetched_at":"2026-10-23T21:34:06+00:00","note":"Read Atlassian advisory (5 Oct 2026, CVSS 4.0 9.3), watchTowr analysis + public detection PoC (6 Oct), BleepingComputer report of in-the-wild exploitation from 7 Oct (honeypot), CISA KEV. Atlassian's own advisory still says no evidence of exploitation; it predates the KEV listing and later reports."},{"source":"nvd","external_id":"CVE-2026-21589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21589","severity":null,"published_at":"2026-10-05T22:16:58+00:00","modified_at":"2026-10-19T20:31:57+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/atlassian-cve-2026-21589-check","url":"https://github.com/CompleteTech-LLC/atlassian-cve-2026-21589-check","severity":null,"published_at":"2026-10-23T23:43:14+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/#CVE-2026-21589","url":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/","severity":null,"published_at":"2026-10-12T17:17:57+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-10-12 · Changelog"},{"source":"lab","external_id":"https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability#CVE-2026-21589","url":"https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability","severity":null,"published_at":"2026-10-07T16:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Akamai: CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai"}],"documents":[{"id":1102,"url":"https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html","title":"Atlassian: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1102,"url":"https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html","title":"Atlassian: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1103,"url":"https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-file-access-flaw-in-jira-confluence/","title":"BleepingComputer: Atlassian warns of critical file-access flaw","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1104,"url":"https://cert.europa.eu/publications/security-advisories/2026-015/","title":"CERT-EU 2026-015: Critical Vulnerability in Multiple Atlassian Products","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1109,"url":"https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/","title":"watchTowr Labs: Pre-Auth Arbitrary File Read CVE-2026-21589","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1110,"url":"https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","title":"watchTowr detection artifact generator for CVE-2026-21589","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1111,"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/","title":"BleepingComputer: Hackers exploit critical Atlassian flaw after public PoC release","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":2249,"url":"https://github.com/CompleteTech-LLC/atlassian-cve-2026-21589-check","title":"CompleteTech-LLC/atlassian-cve-2026-21589-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-21589: Atlassian self-managed products: Data Center arbitrary file access. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:43:14+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2841,"url":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/","title":"Cloudflare: WAF Release - 2026-10-12 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-10-12 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 12, 2026\n\n## WAF Release - 2026-10-12\n\nThis release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.\n\nKey Findings\n\n- CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.\n- CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule \"Generic Rules - Template Injection - 2\" (ID: ...d3ed0123). |\n| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |","published_at":"2026-10-12T17:17:57+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"},{"id":2891,"url":"https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability","title":"Akamai: CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai","kind":"advisory","source":"lab","text":"CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai\n\n# CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products \n\n October 07, 2026 by Akamai Security Intelligence Group \n\nOn October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. CVE-2026-21589 carries a maximum CVSS v4.0 score of 9.3. The vulnerability stems from a path traversal flaw.\n\nAn unauthenticated remote attacker could exploit this vulnerability to read specific files within the web application root directory of affected Atlassian products. Although the vulnerability does not allow directory enumeration, attackers with knowledge of exact filenames could access sensitive information, such as configuration files containing plain-text credentials.\n\nThe patch is available immediately, and Atlassian has urged self-hosted users to upgrade to fixed releases as soon as possible. Cloud users are not affected as Atlassian has already applied fixes.\n\n## Mitigation with Akamai App & API Protector \n\nAkamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts. \n\n- Adaptive Security Engine: 3000990 v1 — Atlassian Pre-Auth Arbitrary File Read Detected (CVE-2026-21589)\n\nThe most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules as recommended by Atlassian is critical to block path traversal and directory traversal attempts.\n\n### Stay tuned \n\nThe Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.","published_at":"2026-10-07T16:00:00+00:00","relation":"advisory","confidence":null,"note":"Akamai disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}