Atlassian CVE-2026-21589 arbitrary file access in Jira / Confluence / Bitbucket Data Center (CISA KEV, exploited): am I affected and which versions fix it?

Am I affected: only self-managed Data Center / Server-style installs are affected. Atlassian Cloud was patched by Atlassian. The affected products are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. An unauthenticated attacker can read specific files under the web application root if they know the exact path; it does not list directories. Exploitation started soon after technical write-ups went public, and CISA added it to the Known Exploited Vulnerabilities catalog. How to check: compare the version shown in each product's admin page (or the About page) against the fixed versions below. Any older build on the same release line is affected. Fix (upgrade to these or later): - Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1 - Confluence Data Center: 9.2.26, 10.2.19 - Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12 - Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12 - Bamboo Data Center: 10.2.24, 12.1.12 - Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4 - Crucible and Fisheye: 4.9.15 Interim mitigation if you can't upgrade right away: take internet-facing instances offline or put them behind VPN/IP allow-lists, and apply the temporary mitigations in Atlassian's advisory (WAF rules, a Tomcat RewriteValve rule, or the Bitbucket URL rewrite rule). Treat these as stopgaps only. After patching: assume any secrets in readable files under the web root may have been exposed. Review access logs for unusual unauthenticated file requests since early October 2026, and rotate credentials or tokens found in configuration files the app serves from that tree. Sources: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-file-access-flaw-in-jira-confluence/ https://www.helpnetsecurity.com/?p=386932 https://www.infosecurity-magazine.com/news/critical-vulnerability-atlassian/