← All incidentsSecurity flaw·Major
Fix availableAttackers already use itAffects website owners
Atlassian Data Center (Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye)What it changes for you
Nothing visible for you; companies must update their Atlassian servers.
A flaw in the self-hosted versions of Atlassian's Jira, Confluence, Bitbucket and other tools lets anyone on the internet read files on the server, and attackers use it. It matters to companies running these servers.
Started Oct 5, 2026Updated Oct 15, 2026
What should I do?
- You
- Nothing to do.
- If you run a website or an app
- Update each self-hosted Atlassian product to a fixed version. If you cannot yet, take the instance off the public internet or add Atlassian's WAF or proxy rule, then check the access logs for path traversal. Atlassian Cloud is already patched.
What is affected
- Atlassian Data Center (Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye)Fixed in Confluence 9.2.26, 10.2.19, Jira Software 9.12.40, 10.3.26, 11.3.12, Jira Service Management 5.12.40, 10.3.26, 11.3.12, Bitbucket 9.4.26, 10.2.8, 10.5.1, Bamboo 10.2.24, 12.1.12, Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4, Crucible and Fisheye 4.9.15
CVE-2026-21589Severity score 9.3 out of 10
Timeline
Fix available · Oct 15, 2026
CISA adds CVE-2026-21589 to its Known Exploited Vulnerabilities catalog.
CISAFix available · Oct 7, 2026
Attacks begin within hours of a public proof of concept, reports the press.
BleepingComputerFix available · Oct 5, 2026
Atlassian publishes CVE-2026-21589, an arbitrary file access flaw in eight Data Center products, with fixed versions. It has no evidence of exploitation yet.
Atlassian