Atlassian CVE-2026-21589: Unauthenticated Access to Files in Web Root Across Multiple Data Center Products

1. Basic Information

• Title: CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products
• Vendor: Atlassian
• Published Date: October 5, 2026
• Last Updated: October 5, 2026
• Update Reason: Technical review: Clarified supported maintenance branches, product-specific temporary mitigations and verification steps, differences in lower bound version notations with the CNA, and criteria for public observations and internal determination.
• Original Advisory: Atlassian
• Related Sources: BleepingComputer, Atlassian CNA: CVE-2026-21589
• Associated Malware: None identified
• Associated Threat Groups: None identified
• Associated CVEs: CVE-2026-21589
• Affected Products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center / self-hosted products
• Severity: Critical

2. Overview

CVE-2026-21589 is a vulnerability that allows unauthenticated remote attackers to read specific files within the web application root of affected Atlassian products. Attackers must know the exact name and path of the target file, as directory enumeration is not possible. Atlassian has assigned a CVSS v4 score of 9.3 and urges immediate updates for all affected products.

3. Attack Flow

1. An attacker connects to an affected self-hosted instance from the internet or a reachable network without authentication.
2. The attacker specifies the exact name and path of the target file and sends a request matching the traversal pattern described in the advisory.
3. If successful, the attacker gains access to the specified file within the web application root. Directory listing and enumeration of the arbitrary filesystem are not supported.
4. If the retrieved file contains secrets or configuration data, it may serve as material for further compromise. Atlassian has not confirmed any evidence of active exploitation.

4. Attacker Position and Execution Location

• Unauthenticated remote attackers with HTTP reachability to the target instance.
• Attacks are processed at the web layer of the Atlassian application, and the readable scope is limited to specific files within the web application root.
• Cloud editions have already been patched by Atlassian, requiring no action from cloud customers.

5. Visibility for Victims and Administrators

• Users: Normal screens may show no visible changes.
• Administrators: Access logs or WAF logs may contain traversal patterns combining .., encoded slashes/backslashes/colons, or semicolons, along with requests to unusual file paths.
• Successful reads should not be determined solely by HTTP status codes; they must be cross-referenced with response sizes, target files, and subsequent authentication or configuration operations.

6. Success and Failure Conditions

Success Conditions

• Network reachability to an affected product version prior to the patched release.
• The presence of a valuable file within the web application root, and the attacker knowing its exact name and path.
• Requests not blocked by temporary mitigations such as a WAF, proxy, RewriteValve, or URL rewrite.

Failure Conditions

• Updating to the patched version corresponding to the product and maintenance branch across all cluster nodes and Bitbucket mirror or mirror farm nodes.
• Disconnecting the instance from the internet or restricting external network access until the update is complete.
• Apply the advisory's WAF/proxy blocking rule to affected products, and test that it blocks the relevant traversal patterns, including URL-encoded variants.
• In-product mitigations use Tomcat's RewriteValve for Confluence, JSM, Jira, Bamboo, and Crowd, and urlrewrite.xml for Bitbucket. Follow the official instructions to take backups, apply the mitigation configuration to all nodes (including mirror and mirror farm nodes for Bitbucket), and perform the product-specific restart steps. Do not apply these in-product procedures to Crucible or Fisheye. Temporary mitigations do not replace patches.

Patched versions are listed below. Each number represents the fix level for a specific product and maintenance branch. Do not assume versions from different branches are patched based on simple numerical comparisons; if a patched version is not listed for a branch, migrate to an officially supported patched version.

The official advisory targets all versions prior to the patched releases. Meanwhile, the CNA record descriptions list introduced versions per product, and the lower-bound notations for affected ranges do not match. Do not exclude older versions based solely on this discrepancy.

7. What Happens Upon Success

• Specific files within the web application root may be read without authentication.
• If the file contents include credentials, tokens, or configuration details, they may be leveraged for subsequent compromises.
• Directory listing, access to the arbitrary filesystem, and code execution have not been confirmed in the advisory.

8. Observable Logs

• Email: There is no description of email being used for initial access.
• Proxy / SWG / DNS: Check for requests containing .., encoded variants of slashes/backslashes/colons, unusually referenced file paths, and response sizes.
• Endpoint / EDR: Monitor application process file reads, unusual access to configuration files, and subsequent child processes or outbound communications. Some configurations may not capture file read telemetry.
• Identity / IdP: Since the exploit occurs before authentication, normal successful logins may not be observed. Separately monitor subsequent logins utilizing leaked secrets.
• SaaS / Cloud: Atlassian Cloud editions have been patched. Verify token usage and configuration changes in integrated self-hosted environments.
• Network: Check for traversal patterns targeting internet-facing instances and scans attempting multiple products or paths from the same source.

9. Determining Attack Success

Confirmed in Public Information

• Atlassian stated at the time of publication that it had found no evidence of exploitation. It has not announced confirmed attack attempts or successful file retrievals.

Internal Determination Criteria

• Attack Attempt Observed (Success Unconfirmed): Treat requests matching detection patterns as investigation candidates, and verify whether they are attack attempts based on the target path, request, and response. Pattern matches alone do not indicate successful file retrieval.
• Information Theft or Session Compromise Confirmed: Correlate traversal patterns, target files, and successful responses. If evidence shows that the contents of private files were returned, conclude that file access was successful.
• Do not determine success based solely on HTTP 200 responses or pattern matches; verify caches, error pages, and rewritten paths.

10. Investigation Playbook

• Investigation Starting Point: Advisory traversal patterns, requests to unknown paths, WAF alerts, and reads of sensitive files.
• Initial Verification: Check the product version, all cluster nodes/mirrors, exposure duration, external reachability, and the application time of temporary mitigations.
• Endpoint / Server Investigation: Preserve access logs, WAF/proxy logs, application logs, file access telemetry, and modification histories for configurations and secrets.
• Authentication / Cloud Investigation: If target files contain credentials or tokens, check usage histories and sessions in integrated systems.
• Tracking Subsequent Activity: Track secret utilization, administrator operations, repository/ticket/page access, child processes, and outbound communications.
• Containment: Restrict external access, preserve evidence, apply patches, and revoke affected credentials or tokens as needed.
• Categorization: Distinguish between scans, request reachability, successful file reads, secret exposures, subsequent authentication, and additional compromises.

11. Defense and Detection Ideas

• Single Events: Detect and block requests matching Atlassian's regular expressions via WAF/proxy.
• Temporal Correlation: Correlate traversal requests → sensitive file responses → logins or administrator operations from new sources.
• Threat Hunting: Search for exposed unpatched Atlassian Data Center products and access to web root files that are not normally referenced.
• Log Limitations: Depending on TLS termination points, URL normalization, and the decoding order of encoded characters, paths visible to proxies and applications may differ.
• Priority Actions: Prioritize updating all nodes, restricting internet exposure, applying temporary WAF rules, and checking for secret exposures.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-21589 is a vulnerability affecting eight self-hosted and Data Center product families that allows unauthenticated access to specific files within the web application root.
• Attackers must know the exact name and path of the file, and directory contents cannot be enumerated.
• Atlassian assigned a CVSS v4 score of 9.3, and Cloud products have been patched. Patched versions for self-hosted products include Bitbucket 9.4.26 / 10.2.8 / 10.5.1, Confluence 9.2.26 / 10.2.19, Jira Service Management 5.12.40 / 10.3.26 / 11.3.12, Jira Software 9.12.40 / 10.3.26 / 11.3.12, Bamboo 10.2.24 / 12.1.12, Crowd 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4, and Crucible / Fisheye 4.9.15.
• Atlassian stated at the time of publication that it had found no evidence of exploitation.

Inference

• In environments where configuration or secret files within the web root were retrieved, credential and token revocations as well as subsequent usage investigations are necessary even after patching.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "14. Unknowns and Additional Investigation".

13. MITRE ATT&CK Mapping

14. Unknowns and Additional Investigation

• The root cause of the vulnerability and differences across products.
• Discrepancies between "all versions" in the advisory and the product-specific introduced versions in the CNA records. Application decisions for older versions require confirmation from Atlassian.
• Presence of active exploitation, public PoCs, or internet scans.
• Retrievable files within each organization's web root and the specific impact of leaks.

15. Impact on SOCs and Organizations

Multiple core development and enterprise products, including Confluence, Jira, and Bitbucket, are affected by this vulnerability. Because instances that are not internet-facing can still be reached from internal networks, organizations should inventory and verify all Data Center nodes and Bitbucket mirrors. Account for URL normalization differences when validating temporary rules, and investigate potential secret exposure alongside patching.

16. Summary by Target Audience

• For SOCs: Correlate traversal patterns, private file responses, and subsequent secret usage; do not determine success based solely on HTTP status codes.
• For Administrators: Update all cluster nodes and mirrors to patched versions, and restrict external reachability until updates are complete.
• For Users: No user action is required. Administrators must update servers and verify compromise status.