CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

This is a path traversal flaw (CWE-552, files or directories accessible to external parties). A remote request with no login can fetch files from inside the web application root. The attacker must already know the target file's exact name and path, and the flaw cannot list directories. Atlassian warns that some configurations hold sensitive files in that root, which raises the severity; the advisory does not name them.

The score is confidentiality only: the attacker reads, but does not write. Even so, source code, ticket and wiki hosts are rich targets. Files in the application root can carry configuration and secrets that lead to further access. A public proof-of-concept detection script from watchTowr exists, and the exploit probability score (EPSS) in the data panel is high, in the 96th percentile.

Internet-facing instances are the main concern. Atlassian says its Cloud products were patched and that it found no evidence of exploitation, but CISA added the flaw to its KEV catalog on 15 October 2026, which means exploitation of Data Center installs has been observed.

All Confluence Data Center versions are affected, including end-of-life ones. The description gives these introduction points: Bitbucket Data Center from 4.6.0, Confluence Data Center from 5.10.0, Crowd Data Center from 2.11.0, Jira Software Data Center from 7.1.0, Jira Service Management Data Center from 3.1.0, Bamboo Data Center from 7.0.1, plus Crucible and Fisheye. Anything below the fixed releases is affected. Find your version in the product's admin About or System Info page, or on the login page footer. Atlassian Cloud sites are already patched.

Upgrade to a fixed version or later:

• Bitbucket Data Center: 9.4.26, 10.2.8 or 10.5.1
• Confluence Data Center: 9.2.26 or 10.2.19
• Crowd Data Center: 6.3.7, 7.0.3, 7.1.7 or 7.2.4
• Jira Software Data Center: 9.12.40, 10.3.26 or 11.3.12
• Jira Service Management Data Center: 5.12.40, 10.3.26 or 11.3.12
• Bamboo Data Center: 10.2.24 or 12.1.12
• Crucible and Fisheye: 4.9.15

If you cannot patch at once, Atlassian's Confluence ticket says to take the instance off the internet or restrict external access. It also offers two limited mitigations: a WAF or proxy rule that blocks URLs with .. next to /, \ or ::, including URL-encoded forms, or Tomcat's RewriteValve with the attached rewrite.config on each node, followed by a restart. These do not replace patching.

CISA's required action: apply mitigations per vendor instructions under BOD 26-04 and its forensics triage requirements, or stop using the product. The due date was 2026-10-18 and binds US federal agencies.

Look in web server and reverse-proxy access logs for requests containing .., %2e%2e, \ or :: sequences, especially with a 200 response and an unusual file name or extension, and for repeated probes from one address. The watchTowr script sends payloads of this kind to test a host, so scanner traffic is expected and not proof of a successful read. Because file reads leave little trace on the server, treat secrets held in the application root as exposed on any unpatched, internet-facing instance and rotate them.

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.