Atlassian CVE-2026-21589: Unauthenticated Arbitrary File Access Response Guide

Every prior KB article on this site followed a confirmed KEV listing. This one doesn't, and that's the point: a CVSS 9.3 flaw in widely self-hosted collaboration tools, with a public PoC and confirmed in-the-wild scanning within hours of disclosure, does not need a CISA deadline to justify emergency patching. Nuclei template coverage for this CVE is expected imminently, which will shift current 'fingerprinting and sweeping' activity toward fully automated, mass-scale exploitation attempts. Waiting for a KEV entry here means waiting for confirmation of something that is already happening.

Jira, Confluence, and Bitbucket Data Center instances are disproportionately internet-facing in organizations that run their own DevOps tooling rather than Atlassian Cloud — exactly the deployment pattern most exposed to this flaw.

Exposure is specific to self-hosted Data Center editions; Atlassian Cloud customers were patched automatically and are not affected.

• •Bitbucket Data Center: affected before 9.4.26, 10.2.8, 10.5.1
• •Confluence Data Center: affected before 9.2.26, 10.2.19
• •Jira Software Data Center: affected before 9.12.40, 10.3.26, 11.3.12
• •Jira Service Management Data Center: affected before 5.12.40, 10.3.26, 11.3.12
• •Bamboo Data Center: affected before 10.2.24, 12.1.12; Crowd Data Center: affected before 6.3.7, 7.0.3, 7.1.7, 7.2.4; Crucible and Fisheye: affected before 4.9.15
• •Any of the above instance reachable from the public internet is the highest-priority target given confirmed scanning activity

Treat this as emergency change-control given the public PoC and already-observed scanning, independent of KEV status.

• •Upgrade to the fixed version listed above for each affected product — this is the only complete remediation
• •Where an immediate upgrade isn't possible, apply Atlassian's published interim mitigations: WAF rules or Tomcat RewriteValve/URL-rewrite rules blocking path-traversal patterns against the webroot
• •Restrict network access to Data Center instances that don't need to be internet-facing, as a compensating control while patching is scheduled
• •Review web server access logs for requests probing for known configuration file paths (e.g. environment files, deployment descriptors) — the signature of current scanning activity — and treat any hit as a potential compromise requiring credential rotation
• •Rotate any credentials or tokens that could plausibly have been stored in a config file reachable from the webroot, if logs show the instance was probed before patching

The shared root cause across Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye points to common web-application-framework code reused across Atlassian's Data Center line — a pattern worth remembering for prioritization, since a fix for one product's advisory does not imply any other product on this list is covered by the same patch cycle. Confirm each deployed product independently against its own fixed-version table above rather than assuming patching one closes exposure on the rest.