Multiple self-hosted Data Center offerings from Atlassian are vulnerable to a critical flaw tracked as CVE-2026-21589 that enables unauthenticated attackers to retrieve files from an affected application's web root. The vulnerability requires attackers to have prior knowledge of the target file's exact name and location; directory enumeration is not possible through this flaw.

According to Atlassian's security advisory, "This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions." The company further notes that "Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents."

Patched versions now available

Atlassian has released security updates addressing CVE-2026-21589 across its Data Center portfolio. All product versions released before the following patch releases are affected:

  • Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
  • Confluence Data Center: 9.2.26, 10.2.19
  • Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
  • Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
  • Bamboo Data Center: 10.2.24, 12.1.12
  • Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
  • Crucible: 4.9.15
  • Fisheye: 4.9.15

Organizations operating self-hosted deployments should deploy these updates without delay. Cloud-based customers require no action, as Atlassian has already applied patches to its managed infrastructure.

Interim mitigation strategies

For environments where immediate patching is not feasible, Atlassian recommends limiting external network connectivity, particularly for internet-exposed instances that demand user authentication. The company has documented several temporary mitigation approaches:

  • Deploy a web application firewall (WAF) or proxy configured to block specified traversal patterns across all affected products
  • Implement Tomcat RewriteValve rules for Confluence, JSM, Jira, Bamboo, and Crowd
  • Configure URL rewrite rules for Bitbucket

These mitigations must be applied consistently across every cluster node, including Bitbucket mirrors and mirror farm nodes. Atlassian's advisory includes detailed step-by-step instructions and configuration parameters for implementing these workarounds.

No active exploitation observed

Atlassian reports having no current evidence of CVE-2026-21589 being leveraged in active attacks. Nevertheless, the company advises administrators to examine access logs for the traversal patterns documented in the security bulletin. Atlassian acknowledges it cannot independently verify whether specific customer instances have been compromised, recommending that organizations running self-hosted deployments coordinate with their internal security teams to assess their exposure.