> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products - URL: https://f4n6.co.uk/security-feed/critical-atlassian-flaw-lets-unauthenticated-attackers-read-known-files-across-8-products/ - Published: 2026-10-06T08:39:43.000Z - Updated: 2026-10-06T08:39:43.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-21589 ## 1\. Executive summary Atlassian disclosed CVE-2026-21589 on 5 October 2026, a path traversal flaw rated CVSS 9.3 (critical) that lets an unauthenticated attacker read specific files inside the web application root directory of eight self-hosted Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. The attacker must already know the exact filename and path and cannot list directory contents, so the flaw is not a bulk data-dump primitive, but Atlassian states that some configurations hold sensitive files in that directory, which raises the impact. The CVE is not in CISA KEV and no exploitation of self-hosted instances has been confirmed. EMEA financial services firms running any of these products on-premises, particularly internet-facing instances, should treat this as a 24-hour patch item because the vulnerable component is reachable without credentials. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | The flaw is in third-party software (Atlassian Data Center) that clients self-host, and Atlassian has issued fixed versions and interim mitigations that clients must apply. | Clients must track the vendor fix through their third-party risk process and confirm the patched version is deployed, not merely that the vendor published one. | | NIS2 Art. 21(2)(d): supply chain security measures | The vulnerability is inherited from a supplier product and the exposure depends on how the client has configured and exposed that product. | Entities in scope must be able to show they assess and act on supplier-issued security advisories affecting their own infrastructure. | No other article in the reference is engaged by the facts here. There is no confirmed incident, so DORA Art. 17, 18 and 19 and NIS2 Art. 23 reporting duties are not triggered by disclosure alone; they would be triggered if a client confirms exploitation of its own instance. ## 3\. Technical analysis & attack chain The flaw is a path traversal in the web application root directory of the affected Data Center products. Atlassian labels it a path traversal in the CVE record. The verified reference data records CVE-2026-21589 at CVSS 9.3, critical, and confirms it is not in CISA KEV. The source material does not name a CWE identifier, so no CWE is asserted here. Confirmed attack chain: 1. The attacker identifies an internet-reachable instance of one of the eight affected Data Center products. No credentials are required. 2. The attacker sends a request whose URL contains a traversal sequence, using `..` directly next to `/`, `\` or `::`, including URL-encoded forms of those sequences. 3. The traversal reaches files inside the web application root directory. The attacker must supply the exact filename and path in advance; the flaw does not permit directory listing. 4. The attacker reads the contents of any file whose path they already know and that is reachable through the traversal. The constraint in step 3 is the main limiter. An attacker cannot enumerate the directory, so exploitation depends on knowing a target filename. Atlassian states that in some configurations sensitive files may be present in the web application root directory, which increases risk. The source does not enumerate which files qualify, so no specific sensitive filename is asserted here. Affected products and fixed versions, as listed by Atlassian as of 6 October 2026\. All versions before the fixed version are affected, including versions that have reached end of life. Atlassian recommends upgrading to a fixed long-term support (LTS) version or later. | Product | Fixed version | | ----------------------------------- | --------------------------------------------------------- | | Bitbucket Data Center | see Atlassian advisory (fixed version listed per product) | | Confluence Data Center | see Atlassian advisory | | Jira Software Data Center | see Atlassian advisory | | Jira Service Management Data Center | see Atlassian advisory | | Bamboo Data Center | see Atlassian advisory | | Crowd Data Center | see Atlassian advisory | | Crucible | see Atlassian advisory | | Fisheye | see Atlassian advisory | The source material does not reproduce the full fixed-version table for all eight products, so the table above points to the vendor advisory rather than inventing version numbers. Two version discrepancies are documented in the source and should be resolved against the vendor ticket before a client relies on them. For Crowd's 7.1 branch, the ticket's fix version field said 7.1.7, while a table in the same ticket showed 7.1.6, which the ticket also listed as an affected version. The CVE record gave different numbers for two products: for Crowd it listed 7.1.1, which the Crowd 7.1 release notes date to 27 November 2025, and for Bamboo one field said 10.2.4 while the record's own description said 10.2.24\. Clients should confirm the correct fixed version against the Atlassian security bulletin for their product before scheduling the change. The CVE record also lists the Server editions of these products, which the advisory did not mention. It marks every version of Bamboo Server, Bitbucket Server, Confluence Server and Crowd Server as affected and lists no fixed versions for them. For Jira Software Server the record lists versions from 9.12.40 as unaffected, for Jira Service Management Server from 5.12.40, and for Crucible Server and Fisheye Server from 4.9.15\. The source does not say whether Server licenses can run those versions. Crowd has had no Server release since version 5.2 in September 2023, so none of the fixed Crowd versions are Server releases. Clients still running Server editions have no vendor-published fixed version to move to and should treat network restriction as the primary control. Atlassian states its affected cloud products have already been patched and that cloud customers need take no action. Bitbucket Cloud is not affected. Atlassian's investigation has not found evidence of exploitation, and the advisory does not say whether attacks on self-hosted instances have been seen. Atlassian states it cannot confirm whether a given customer's instances have been affected, and directs customers to have their security teams search access logs. The source material is truncated at that point, so the specific log search guidance is not reproduced here; clients should read the vendor advisory for the exact log fields and time window. Confidence note: the technical mechanism, affected product list and mitigation options are corroborated across the primary item and the related Register and external sources. The fixed-version numbers are single-sourced to the Atlassian ticket and CVE record as reported, and the source itself flags internal inconsistencies in those numbers. Verify against the vendor bulletin before enforcement. ## 4\. Mitigation & containment P1 within 24 hours - Inventory every self-hosted instance of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye, including nodes, mirrors and mirror farm nodes. Record version, network exposure and whether the instance is reachable from the public internet. - For any instance reachable from the public internet, including instances that require a login, restrict external network access until the instance is upgraded or a temporary blocking rule is in place. Atlassian explicitly advises this for instances that cannot be upgraded all at once. - Where a WAF or reverse proxy fronts the instance, deploy the vendor blocking rule that rejects requests whose URL contains `..` directly next to `/`, `\` or `::`, including URL-encoded forms. This rule applies to all eight products. - Begin the upgrade to the fixed version for each product. Confirm the correct fixed version against the Atlassian security bulletin, given the version discrepancies noted in section 3. P2 within 72 hours - For Confluence, Jira Software, Jira Service Management, Bamboo and Crowd, deploy the Tomcat RewriteValve rule on each node. The node must be shut down and restarted for the rule to take effect. - For Bitbucket, deploy the rule in `urlrewrite.xml` on every node, mirror and mirror farm node, then restart. Crucible and Fisheye have no product-level rewrite option and rely on the WAF or reverse proxy rule only. - Treat the rewrite rules as interim. Atlassian states the mitigations are limited and are not a replacement for patching. - Have the security team search instance access logs for traversal attempts against the web application root, using the log guidance in the vendor advisory. Atlassian cannot confirm whether a given instance has been affected, so this review is the only way to establish past access. P3 within 7 days - Complete upgrades on all remaining instances, including internal-only instances, and confirm the running version matches the fixed version. - For Server editions with no published fixed version (Bamboo Server, Bitbucket Server, Confluence Server, Crowd Server), keep network restriction in place and plan migration to a supported Data Center or cloud deployment. - Review what files sit in each product's web application root directory and remove or relocate anything sensitive, since the flaw's impact depends on what is present there. ## 5\. Indicators of compromise No atomic indicators of compromise are available in the source material. Atlassian states its investigation has not found evidence of exploitation, and the source does not publish hashes, domains, IP addresses or file paths associated with exploitation. The sources do describe one observable behaviour: traversal requests against the web application root directory, using `..` adjacent to `/`, `\` or `::`, including URL-encoded forms. This is a behaviour to hunt for in logs, not an atomic indicator, and is recorded below. Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | Request URL contains .. directly next to /, \\ or ::, including URL-encoded forms, targeting the web application root directory | Web server, reverse proxy or WAF access logs for the affected Atlassian products | High, this is the traversal pattern Atlassian's own blocking rules are built to match | ## 6\. Detection The sources give a usable behavioural artefact: the traversal pattern Atlassian's blocking rules match. A Sigma rule can detect the request pattern in web access logs. No file hash, mutex, registry key or malware string is present in the sources, so no YARA rule is emitted. ```yaml title: Atlassian Data Center Path Traversal Attempt (CVE-2026-21589) id: 7c1f4a2e-9b3d-4e6a-8f21-0d5c6b7a9e10 status: experimental description: Detects HTTP requests containing a path traversal sequence adjacent to a slash, backslash or double colon, matching the pattern Atlassian's interim blocking rules target for CVE-2026-21589 in Data Center products. author: Adverse Trace date: 2026-10-06 references: - https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html logsource: category: webserver detection: selection_traversal: cs-uri-query|contains: - '../' - '..\\' - '..::' - '%2e%2e%2f' - '%2e%2e%5c' - '%2e%2e/' - '..%2f' - '..%5c' condition: selection_traversal falsepositives: - Legitimate applications that pass relative paths in query strings level: high ``` The rule matches the traversal sequences named in the source. Tune against normal traffic for the affected products before alerting, since some legitimate requests may contain relative path fragments. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-21589](https://nvd.nist.gov/vuln/detail/CVE-2026-21589?ref=f4n6.co.uk) | 9.3 Critical | — | — | h3\. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jir… | ## 7\. Sources - The Hacker News, "Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products", https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html, 2026-10-06. - The Register, "Atlassian warns of critical file access flaw in its datacenter products", https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/5301284, 2026-10-06. - ANSSI CERT-FR, "Multiples vulnérabilités dans les produits Atlassian", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0934/, 2026-07-27. - ANSSI CERT-FR, "Multiples vulnérabilités dans les produits Atlassian", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0773/, 2026-06-18. - SecurityWeek, "Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities", https://www.securityweek.com/atlassian-splunk-patch-dozens-of-critical-high-severity-vulnerabilities/. - GitHub Security Advisories, GHSA-vxxr-hxj5-58vp (CVE-2026-21582, Crowd Data Center), https://github.com/advisories/GHSA-vxxr-hxj5-58vp. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-21589 as a high-urgency patch item for EMEA financial services clients running self-hosted Atlassian Data Center products, driven by the CVSS 9.3 critical rating and unauthenticated reachability rather than by any confirmed exploitation. The CVE is not in CISA KEV and Atlassian has found no evidence of exploitation, so this is a pre-exploitation exposure, not an active incident. The practical risk is concentrated in internet-facing instances and in whatever sensitive files a client has left in the web application root directory. Clients on Atlassian cloud have no action to take. We will monitor for exploitation reporting and for any KEV addition, and we will update this advisory if the vendor fixed-version discrepancies are resolved or if evidence of in-the-wild use emerges. Clients should confirm their patched version against the Atlassian bulletin directly, given the version inconsistencies in the source material. --- [Read the original source →](https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*