Atlassian Data Center: CVE-2026-21589, unauthenticated file read

📌 Later developments: Atlassian CVE-2026-21589 added to CISA KEV: it is exploited (October 15, 2026)

On 5 October 2026 Atlassian published a bulletin on a critical vulnerability affecting several of its self-managed products (Data Center editions): CVE-2026-21589, with a CVSS 4.0 score of 9.3. It allows an unauthenticated attacker to read specific files located in the web application root directory. Atlassian Cloud has already been fixed, and cloud customers do not need to do anything.

Between 6 and 8 October, advisories were published by CERT-FR, NCSC-NL, CERT-EU, BSI/CERT-Bund, NCSC-FI and the Canadian Centre for Cyber Security.

What happened

According to CERT-EU, which draws on the vendor’s bulletin, this is an arbitrary file access vulnerability. NCSC-FI specifies that it can be exploited over the network, without credentials and without any user action. It does have a limit: the attacker must know the exact name and path of the file in advance, because the vulnerability does not allow directory contents to be listed. Atlassian warns that some configurations may contain sensitive files, which increases the risk.

The agencies rate it in similar terms: CERT-FR speaks of a breach of data confidentiality, BSI of information disclosure with high severity, and NCSC-NL rated its advisory (NCSC-2026-0402) as M/H, meaning medium likelihood and high damage. CERT-EU and NCSC-FI call it critical.

Exploitation: the sources do not agree

The advisories, released on different days, describe a picture that has evolved:

• according to CERT-EU (7 October), Atlassian states that its investigation has found no evidence of exploitation;
• the Canadian Centre for Cyber Security, in its 7 October update, reports that open-source reporting indicates CVE-2026-21589 is being exploited in the wild;
• NCSC-FI (8 October) reports that a working proof of concept and a template for automated vulnerability scanners have been published, and that exploitation attempts were seen on the Internet soon afterwards. It adds, however, that public observations so far concern decoy systems (honeypots), not confirmed breaches of organisations.

Technical details

• CVE: CVE-2026-21589, CVSS 4.0 9.3 (critical).
• Flaw type: arbitrary access to files in the web application root directory, with no ability to list directories.
• Vector: network, no authentication, no user interaction.
• What to look for in requests: the mitigations and checks given by Atlassian target .. sequences immediately next to /, \ or ::, including URL-encoded forms.
• MITRE ATT&CK: exploiting an exposed service maps to T1190 (Exploit Public-Facing Application).
• Fixed versions according to CERT-EU (all earlier versions are affected):
  • Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1;
  • Confluence Data Center: 9.2.26, 10.2.19;
  • Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12;
  • Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12;
  • Bamboo Data Center: 10.2.24, 12.1.12;
  • Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4;
  • Crucible and Fisheye: 4.9.15.

The agencies’ lists are not identical. CERT-FR gives the same versions but does not mention Jira Service Management. The Canadian Centre also includes the Server editions (for Bamboo, Bitbucket, Confluence and Crowd Server it states “all versions”) and lists versions with a different notation and, for some branches, different numbers. Atlassian recommends moving to the fixed LTS version or later: check the bulletin for the exact number for your branch.

Impact for European and Italian companies

The affected products support the daily work of many teams: Jira and Confluence for tickets and documentation, Bitbucket for source code, Bamboo for builds and releases, Crowd for centralised access management. How serious an unauthorised read is depends on which files can be reached. Among the actions to take after possible exploitation, NCSC-FI lists replacing Crowd and application credentials, API keys and other secrets, and checking for new users, administrators and permission changes.

For entities in scope of NIS2, the reading of credentials or secrets from an exposed system is an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.

What to do now

1. Inventory: identify every self-managed Atlassian installation. NCSC-FI recommends also checking cluster nodes, test environments, Bitbucket mirrors and any other instance reachable from the Internet.
2. Update to the fixed versions or later, starting with Internet-facing instances, as CERT-EU recommends.
3. If you cannot update right away: take the instance off the Internet until it is fixed, even if it requires login. Alternatively, Atlassian gives three mitigations:
   • option 1 (all products): a rule on the WAF or proxy that blocks URLs matching the regular expression shown below; then test that it really blocks .. next to /, \ or ::, including encoded forms;
   • option 2 (Confluence, Jira Service Management, Jira, Bamboo and Crowd): on each node, enable Tomcat’s RewriteValve in the application’s <Context> element and install a rewrite.config file in the WEB-INF directory;
   • option 3 (Bitbucket only): add a blocking rule at the top of ./app/WEB-INF/urlrewrite.xml on all nodes, mirrors and mirror farm nodes, then restart Bitbucket Data Center. Back up the instance before options 2 and 3. The exact configurations are in Atlassian’s bulletin.
4. Check the access logs: URL-decode each request line and look for .. immediately next to /, \ or ::, or search the raw, non-decoded lines with the same regular expression.
5. If you find traces: work out which files may have been read, replace credentials and secrets that may have been exposed, check for new users and administrators, group memberships and permission changes, and contact the relevant authority.

The regular expression given by Atlassian, as reported by CERT-EU:

(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*

Before using it in production, compare it with the one in the bulletin.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a Jira, Confluence or Bitbucket instance is reachable from outside. ARX Shield lists open vulnerabilities by machine and by package on monitored machines, highlighting those already exploited. With ARX Trace, analysts can launch collections and searches across multiple machines to check for traces.

Last updated: 8 October 2026