CVE-2026-21589: Atlassian Products Arbitrary File Access Exploited in Attacks

Impacted systems

Exploitation conditions

A remote unauthenticated attacker with network access to an affected self-managed Atlassian application can read specific files under the web application root. Exploitation requires prior knowledge of the exact target file name and path; the flaw does not provide directory listing or enumeration. Public technical details and proof-of-concept material are available, and active exploitation has been observed after the PoC release. In certain Crowd-integrated deployments, exposed files may contribute to a path toward administrator-level access. Treat successful compromise as confirmed only with local evidence.

Recommended action

• Patch every affected self-managed installation to the fixed version or a later supported release listed in Atlassian's advisory. Prioritise internet-facing systems.
• Inventory all eight affected product families: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.
• If patching cannot be completed immediately, remove the instance from public internet access where possible, including instances protected by login, until patched or safely mitigated.
• Review web, reverse-proxy and application access logs for path-traversal patterns where '..' is adjacent to '/', backslash or '::', including URL-encoded variants. URL-decode request lines during analysis.
• Correlate suspicious requests with source IPs, response codes, timestamps, authentication events and subsequent administrative activity. Preserve logs and investigate unexpected file access.
• Where secrets or credentials may have been exposed, rotate them and investigate connected systems. For Crowd-integrated environments, review authentication and administrator activity across connected Atlassian applications.
• If using a WAF or reverse proxy as temporary mitigation, implement and test the exact filtering guidance in Atlassian's advisory, including encoded path traversal forms. Validate changes carefully to avoid disrupting legitimate traffic.

Workarounds

• Preferred temporary mitigation: remove affected instances from internet exposure until patching or mitigation is complete, where possible.

• Temporary WAF/proxy mitigation (Atlassian-supplied, all affected products): block requests whose URL contains a path-traversal sequence — the characters '..' immediately next to '/', '\', or '::', including URL-encoded forms such as %2e%2e%2f. Deploy this vendor regex on your WAF or reverse proxy (copy exactly; test before production):

  (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*

• This WAF rule is temporary mitigation only and does not replace patching. Configure it for your specific WAF product and confirm legitimate traffic is not blocked.

• Atlassian also provides product-specific alternatives: Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira Software, Bamboo and Crowd; and a urlrewrite.xml rule for Bitbucket. Follow the exact vendor instructions, back up configuration, and apply to every cluster node/mirror where applicable.

Sources

• Atlassian Security Advisory: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products ↗
• watchTowr Labs: Pre-authentication arbitrary file read in Atlassian Jira, Confluence and more ↗
• BleepingComputer: Hackers exploit critical Atlassian flaw after public PoC release ↗