Atlassian Jira, Confluence (and more) Arbitrary File Read Vulnerability (CVE-2026-21589)

What it is

CVE-2026-21589 is an unauthenticated arbitrary file read in eight self-hosted Atlassian products: Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. It has a CVSS 3.1 score of 7.5 (High). Atlassian found it internally and published fixes for every product on 5 October 2026. CISA added it to the KEV catalog on 15 October 2026, so exploitation in the wild is confirmed.

Preconditions / Affected

• Every version of the eight products before the fixed releases is affected, and the default install is vulnerable. The page does not list the fixed version numbers, so take them from Atlassian's advisory.
• The attacker needs only network access. No account is required.
• The attacker must already know the exact file name and path. The flaw gives no way to browse or list the web root.
• Only files inside the application's web root can be read. Deployments that keep sensitive files there carry added risk.
• Atlassian Cloud was already patched, so cloud customers need no action.

What to do

1. Update each Data Center or Server instance to its fixed version. Prioritize internet-facing instances.
2. If patching must wait, take the instance off the public internet, even if it sits behind a login.
3. Add Atlassian's published WAF regex rule to block path traversal patterns.
4. Enable the Tomcat RewriteValve mitigation (Bitbucket uses urlrewrite.xml) on every cluster node, then restart each node. Atlassian attached a rewrite.config file to the public Jira ticket on 2 October 2026.
5. Search web server access logs for request paths with two dots next to a slash, a backslash or a double colon. Decode each URL up to twice before matching, so encoded traversal is caught.

Atlassian cannot tell from its side whether a given instance was affected. Each organization has to check its own logs for signs of compromise.

Caveats

Atlassian says its temporary mitigations do not fully replace patching. The page gives no regex text, exploit details, indicators of compromise or fixed version numbers. It refers readers to the vendor advisory for those and for later changes.