---
id: "CVE-2026-21589"
kind: "vulnerability"
aliases: ["CVE-2026-21589"]
title: "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "resolved"
category: "vendor"
products: [{"name": "Atlassian Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Bitbucket Data Center", "fixed": ["9.4.26", "10.2.8", "10.5.1"], "affected": "< 9.4.26; >= 10.0, < 10.2.8; >= 10.3, < 10.5.1", "ecosystem": "vendor"}, {"name": "Confluence Data Center", "fixed": ["9.2.26", "10.2.19"], "affected": "< 9.2.26; >= 10.0, < 10.2.19", "ecosystem": "vendor"}, {"name": "Jira Service Management Data Center", "fixed": ["5.12.40", "10.3.26", "11.3.12"], "affected": "< 5.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12", "ecosystem": "vendor"}, {"name": "Jira Software Data Center", "fixed": ["9.12.40", "10.3.26", "11.3.12"], "affected": "< 9.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12", "ecosystem": "vendor"}, {"name": "Bamboo Data Center", "fixed": ["10.2.24", "12.1.12"], "affected": "< 10.2.24; >= 12.0, < 12.1.12", "ecosystem": "vendor"}, {"name": "Crowd Data Center", "fixed": ["6.3.7", "7.0.3", "7.1.7", "7.2.4"], "affected": "< 6.3.7; 7.0.x < 7.0.3; 7.1.x < 7.1.7; 7.2.x < 7.2.4", "ecosystem": "vendor"}, {"name": "Crucible", "fixed": ["4.9.15"], "affected": "< 4.9.15", "ecosystem": "vendor"}, {"name": "Fisheye", "fixed": ["4.9.15"], "affected": "< 4.9.15", "ecosystem": "vendor"}, {"name": "atlassian bitbucket data center", "fixed": ["9.4.26"], "affected": ">= 7.17.0, < 9.4.26", "ecosystem": "vendor"}, {"name": "atlassian bitbucket data center", "fixed": ["10.2.8"], "affected": ">= 9.5.0, < 10.2.8", "ecosystem": "vendor"}, {"name": "atlassian bitbucket data center", "fixed": ["10.5.1"], "affected": ">= 10.3.0, < 10.5.1", "ecosystem": "vendor"}, {"name": "atlassian bitbucket server", "fixed": [], "affected": ">= 4.6.0, <= 8.14.6", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["9.2.26"], "affected": ">= 5.10.0, < 9.2.26", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["10.2.19"], "affected": ">= 9.3.0, < 10.2.19", "ecosystem": "vendor"}, {"name": "atlassian crowd", "fixed": ["6.3.7"], "affected": ">= 2.11.0, < 6.3.7", "ecosystem": "vendor"}, {"name": "atlassian crowd", "fixed": ["7.0.3"], "affected": ">= 7.0.0, < 7.0.3", "ecosystem": "vendor"}, {"name": "atlassian crowd", "fixed": ["7.1.7"], "affected": ">= 7.1.0, < 7.1.7", "ecosystem": "vendor"}, {"name": "atlassian crowd", "fixed": ["7.2.4"], "affected": ">= 7.2.0, < 7.2.4", "ecosystem": "vendor"}, {"name": "atlassian jira data center", "fixed": ["9.12.40"], "affected": ">= 7.1.0, < 9.12.40", "ecosystem": "vendor"}, {"name": "atlassian jira data center", "fixed": ["10.3.26"], "affected": ">= 9.13.0, < 10.3.26", "ecosystem": "vendor"}, {"name": "atlassian jira data center", "fixed": ["11.3.12"], "affected": ">= 10.4.0, < 11.3.12", "ecosystem": "vendor"}, {"name": "atlassian jira service desk", "fixed": [], "affected": ">= 3.1.0, <= 4.13.27", "ecosystem": "vendor"}, {"name": "atlassian jira service management", "fixed": ["5.12.40"], "affected": ">= 4.14.0, < 5.12.40", "ecosystem": "vendor"}, {"name": "atlassian jira service management", "fixed": ["10.3.26"], "affected": ">= 5.13.0, < 10.3.26", "ecosystem": "vendor"}, {"name": "atlassian jira service management", "fixed": ["11.3.12"], "affected": ">= 10.4.0, < 11.3.12", "ecosystem": "vendor"}, {"name": "atlassian bamboo", "fixed": ["10.2.24"], "affected": ">= 7.0.1, < 10.2.24", "ecosystem": "vendor"}, {"name": "atlassian bamboo", "fixed": ["12.1.12"], "affected": ">= 11.0.0, < 12.1.12", "ecosystem": "vendor"}, {"name": "atlassian crucible", "fixed": ["4.9.15"], "affected": "< 4.9.15", "ecosystem": "vendor"}, {"name": "atlassian fisheye", "fixed": ["4.9.15"], "affected": "< 4.9.15", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["akamai", "atlassian", "bamboo", "bitbucket", "cloudflare", "confluence", "crowd", "crucible", "data-center", "exploited", "fisheye", "jira", "lab-disclosure", "path-traversal", "poc-public", "pre-auth", "self-hosted", "vendor"]
not_affected_if: ["atlassian-cloud", "non-data-center-deployment"]
published_at: "2026-10-05T22:16:58+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-24T18:43:45+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:34:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "github-poc", "url": "https://github.com/CompleteTech-LLC/atlassian-cve-2026-21589-check", "first_seen_at": "2026-10-23T23:55:02+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/", "first_seen_at": "2026-10-24T17:18:15+00:00"}, {"source": "lab", "url": "https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability", "first_seen_at": "2026-10-24T18:43:45+00:00"}]
---

# This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira…

Pre-auth arbitrary file read in eight self-hosted Atlassian products (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye Data Center). Flaw is in shared web-resource handling: '::' is decoded to '/', so '..::' traversal reaches files under WEB-INF (e.g. web.xml) without login. Needs exact file path; no directory listing. File disclosure, not RCE, but exposed config can hold credentials. Exploited in the wild after watchTowr's public write-up and PoC; in CISA KEV. Atlassian Cloud already patched.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Multiple Products affected ? fixed ?
- vendor:Bitbucket Data Center affected < 9.4.26; >= 10.0, < 10.2.8; >= 10.3, < 10.5.1 fixed 9.4.26, 10.2.8, 10.5.1
- vendor:Confluence Data Center affected < 9.2.26; >= 10.0, < 10.2.19 fixed 9.2.26, 10.2.19
- vendor:Jira Service Management Data Center affected < 5.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12 fixed 5.12.40, 10.3.26, 11.3.12
- vendor:Jira Software Data Center affected < 9.12.40; >= 10.0, < 10.3.26; >= 11.0, < 11.3.12 fixed 9.12.40, 10.3.26, 11.3.12
- vendor:Bamboo Data Center affected < 10.2.24; >= 12.0, < 12.1.12 fixed 10.2.24, 12.1.12
- vendor:Crowd Data Center affected < 6.3.7; 7.0.x < 7.0.3; 7.1.x < 7.1.7; 7.2.x < 7.2.4 fixed 6.3.7, 7.0.3, 7.1.7, 7.2.4
- vendor:Crucible affected < 4.9.15 fixed 4.9.15
- vendor:Fisheye affected < 4.9.15 fixed 4.9.15
- vendor:atlassian bitbucket data center affected >= 7.17.0, < 9.4.26 fixed 9.4.26
- vendor:atlassian bitbucket data center affected >= 9.5.0, < 10.2.8 fixed 10.2.8
- vendor:atlassian bitbucket data center affected >= 10.3.0, < 10.5.1 fixed 10.5.1
- vendor:atlassian bitbucket server affected >= 4.6.0, <= 8.14.6 fixed ?
- vendor:atlassian confluence data center affected >= 5.10.0, < 9.2.26 fixed 9.2.26
- vendor:atlassian confluence data center affected >= 9.3.0, < 10.2.19 fixed 10.2.19
- vendor:atlassian crowd affected >= 2.11.0, < 6.3.7 fixed 6.3.7
- vendor:atlassian crowd affected >= 7.0.0, < 7.0.3 fixed 7.0.3
- vendor:atlassian crowd affected >= 7.1.0, < 7.1.7 fixed 7.1.7
- vendor:atlassian crowd affected >= 7.2.0, < 7.2.4 fixed 7.2.4
- vendor:atlassian jira data center affected >= 7.1.0, < 9.12.40 fixed 9.12.40
- vendor:atlassian jira data center affected >= 9.13.0, < 10.3.26 fixed 10.3.26
- vendor:atlassian jira data center affected >= 10.4.0, < 11.3.12 fixed 11.3.12
- vendor:atlassian jira service desk affected >= 3.1.0, <= 4.13.27 fixed ?
- vendor:atlassian jira service management affected >= 4.14.0, < 5.12.40 fixed 5.12.40
- vendor:atlassian jira service management affected >= 5.13.0, < 10.3.26 fixed 10.3.26
- vendor:atlassian jira service management affected >= 10.4.0, < 11.3.12 fixed 11.3.12
- vendor:atlassian bamboo affected >= 7.0.1, < 10.2.24 fixed 10.2.24
- vendor:atlassian bamboo affected >= 11.0.0, < 12.1.12 fixed 12.1.12
- vendor:atlassian crucible affected < 4.9.15 fixed 4.9.15
- vendor:atlassian fisheye affected < 4.9.15 fixed 4.9.15

## How to check

Check your product version against the fixed list. Search access logs for '..' next to '/', '\' or '::' (URL-decode up to two passes), or run Atlassian's regex on raw lines. Look for hits on /download/resources/... containing '..::' and WEB-INF. Treat any WEB-INF/config secrets (e.g. DB or Crowd credentials) on hit instances as exposed and rotate them. watchTowr's detection script (-H host) tests Jira, Confluence, Bitbucket.

## Fix

Upgrade: Bitbucket DC 9.4.26/10.2.8/10.5.1; Confluence DC 9.2.26/10.2.19; JSM DC 5.12.40/10.3.26/11.3.12; Jira Software DC 9.12.40/10.3.26/11.3.12; Bamboo DC 10.2.24/12.1.12; Crowd DC 6.3.7/7.0.3/7.1.7/7.2.4; Crucible 4.9.15; Fisheye 4.9.15. If you cannot patch: take the instance off the internet, and block requests with a WAF/proxy regex for '..' adjacent to / \ or :: (also URL-encoded), or use Tomcat RewriteValve rules (Confluence/Jira/JSM/Bamboo/Crowd) or a urlrewrite.xml rule (Bitbucket), on every node including Bitbucket mirrors. Exact rules are in the Atlassian advisory.

## Mitigated for you by

- Akamai (waf-rule): covers Akamai App & API Protector customers, via Adaptive Security Engine rule 3000990 v1 (Atlassian Pre-Auth Arbitrary File Read Detected) Limits: none stated Still: apply vendor patches promptly; the rule detects exploitation attempts and is not described as a complete fix https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability
- Cloudflare (waf-rule, since 2026-10-12): covers Requests matching the Atlassian arbitrary file access pattern, via Cloudflare Managed Ruleset rule Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 Limits: Only traffic proxied through Cloudflare; the rule covers only the detected pattern Still: none stated https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589
- 2026-10-23T21:34:06+00:00 analyst — Read Atlassian advisory (5 Oct 2026, CVSS 4.0 9.3), watchTowr analysis + public detection PoC (6 Oct), BleepingComputer report of in-the-wild exploitation from 7 Oct (honeypot), CISA KEV. Atlassian's own advisory still says no evidence of exploitation; it predates the KEV listing and later reports.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-21589
- 2026-10-23T23:55:02+00:00 github-poc https://github.com/CompleteTech-LLC/atlassian-cve-2026-21589-check
- 2026-10-24T17:18:15+00:00 lab https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/ — Cloudflare: WAF Release - 2026-10-12 · Changelog
- 2026-10-24T18:43:45+00:00 lab https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability — Akamai: CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai

## Documents

- [advisory] Atlassian: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
- [advisory] CERT-EU 2026-015: Critical Vulnerability in Multiple Atlassian Products https://cert.europa.eu/publications/security-advisories/2026-015/
- [advisory] Cloudflare: WAF Release - 2026-10-12 · Changelog https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/
- [advisory] Akamai: CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai https://www.akamai.com/blog/security-research/2026/oct/cve-2026-21589-atlassian-arbitrary-file-read-vulnerability
- [describes] BleepingComputer: Atlassian warns of critical file-access flaw https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-file-access-flaw-in-jira-confluence/
- [describes] watchTowr Labs: Pre-Auth Arbitrary File Read CVE-2026-21589 https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/
- [discussion] BleepingComputer: Hackers exploit critical Atlassian flaw after public PoC release https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/
- [mitigation] Atlassian: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
- [poc] watchTowr detection artifact generator for CVE-2026-21589 https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
- [poc] CompleteTech-LLC/atlassian-cve-2026-21589-check https://github.com/CompleteTech-LLC/atlassian-cve-2026-21589-check

## From the sources

CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | Akamai

# CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products 

 October 07, 2026 by Akamai Security Intelligence Group 

On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. CVE-2026-21589 carries a maximum CVSS v4.0 score of 9.3. The vulnerability stems from a path traversal flaw.

An unauthenticated remote attacker could exploit this vulnerability to read specific files within the web application root directory of affected Atlassian products. Although the vulnerability does not allow directory enumeration, attackers with knowledge of exact filenames could access sensitive information, such as configuration files containing plain-text credentials.

The patch is available immediately, and Atlassian has urged self-hosted users to upgrade to fixed releases as soon as possible. Cloud users are not affected as Atlassian has already applied fixes.

## Mitigation with Akamai App & API Protector 

Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts. 

- Adaptive Security Engine: 3000990 v1 — Atlassian Pre-Auth Arbitrary File Read Detected (CVE-2026-21589)

The most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules as recommended by Atlassian is critical to block path traversal and directory traversal attempts.

### Stay tuned 

The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_