Atlassian Patches: Exploited Jira and Confluence Flaw and 75 More

If your organisation runs its own Jira, Confluence, Bitbucket or other Atlassian server instead of using Atlassian Cloud, October has been a busy month. An actively exploited file-reading flaw was followed on October 20 by a large security bulletin covering dozens more bugs. This article is for IT managers, software teams and service providers who host Atlassian tools on their own servers or in a private cloud.

Key takeaways

• CVE-2026-21589, rated 9.3, lets an unauthenticated attacker read certain files on self-managed Atlassian products. It has been reported as exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities catalogue on October 15.
• Atlassian’s October 20 bulletin lists 176 entries mapping to 75 unique CVEs, six of them critical, all in third-party components such as Apache Tomcat, Netty, Bouncy Castle and Apache SSHD.
• Atlassian Cloud customers need no action. Self-managed Data Center and Server customers do.
• Update to the fixed or latest version, and take internet-facing servers offline if you cannot patch quickly.

The exploited flaw: CVE-2026-21589

Atlassian disclosed CVE-2026-21589 on October 5. Singapore’s Cyber Security Agency describes it as a path traversal issue that allows a remote attacker, without logging in, to read specific files in the web application’s root directory. Depending on how a server is configured, those files can include configuration files, credentials and tokens that open the door to deeper attacks.

The attacker must already know the exact name and location of the file, and the bug does not list directory contents. That limitation offered little comfort for long. The Canadian Centre for Cyber Security updated its advisory to note open-source reports of exploitation, and CISA added the bug to its exploited list on October 15. SecurityWeek reported that attackers started targeting it within hours of proof-of-concept code being published.

Products affected

Self-hosted versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye are all listed. Server editions that have reached end of support are affected in all versions.

Fixed versions for CVE-2026-21589

• Confluence Data Center: 9.2.26 or 10.2.19
• Jira Software Data Center: 9.12.40, 10.3.26 or 11.3.12
• Jira Service Management Data Center: 5.12.40, 10.3.26 or 11.3.12
• Bitbucket Data Center: 9.4.26, 10.2.8 or 10.5.1
• Bamboo Data Center: 10.2.24 or 12.1.12
• Crucible and Fisheye: 4.9.15

Newer releases also contain the fix. Always confirm against Atlassian’s own advisory for your exact branch.

The October 20 bulletin

Atlassian’s monthly bulletin, published on October 20, lists 162 high-severity and 14 critical-severity entries across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. SecurityWeek counted 75 unique CVEs, six of them critical. All of them sit in third-party libraries that Atlassian bundles.

The critical components

• Apache Tomcat (three critical CVEs), listed for Confluence and Crowd
• Bouncy Castle, listed for Confluence, Crowd, Jira Software and Jira Service Management
• Netty, listed for Confluence, Jira Software and Jira Service Management
• Apache SSHD, listed for Fisheye/Crucible

Atlassian says the way its products use these components presents a lower, non-critical risk, and it has not reported any exploitation. The high-severity entries include denial-of-service bugs as well as authentication, server-side request forgery, information disclosure and code execution issues in libraries such as Jackson, Spring, Apache Struts and Apache ActiveMQ.

Why self-hosted Atlassian servers are attractive targets

Jira and Confluence often hold a company’s most useful information: project plans, customer tickets, internal procedures, and sometimes passwords pasted into pages that should never have held them. Bitbucket holds source code. Security reporters note that internet-exposed Atlassian products are a recurring target, including for ransomware groups. Many African software houses, banks, telecom operators and public agencies host these tools themselves to keep data local or control costs, so the patching job falls on in-house teams.

How to patch safely

1. Find every instance. Include test, staging and forgotten servers. Check the version in each product’s administration area.
2. Prioritise internet-facing systems. Confluence, Jira and Crowd servers reachable from the internet come first.
3. Back up first. Take a database backup and a snapshot of the application and home directories.
4. Upgrade to a fixed or newer release, preferably a supported Long Term Support (LTS) version.
5. Don’t patch bundled Tomcat yourself. Atlassian ships its own Tomcat build, so wait for and apply Atlassian’s updates instead.
6. Check for signs of intrusion after patching. Review web server logs for unusual file requests and rotate any credentials or tokens stored in configuration files.

If you can’t upgrade immediately

Remove the instance from the internet until it is patched, or place it behind a VPN. Atlassian’s advisory for CVE-2026-21589 also provides temporary mitigations, including a web application firewall or reverse-proxy rule and Tomcat rewrite rules, which require editing configuration files and restarting each node.

What you should do

• Confirm whether you run any self-managed Atlassian product. If you only use Atlassian Cloud, no action is needed.
• Patch CVE-2026-21589 now. It is being exploited.
• Schedule upgrades to the latest LTS releases to pick up the October 20 third-party fixes.
• Rotate credentials, API tokens and keys stored on servers that were exposed before patching.
• Move unsupported Server editions to a supported Data Center release or to Atlassian Cloud.

Sources

• Atlassian Patches 75 Flaws in Data Center and Server Products – SecurityWeek
• Atlassian Security Bulletin October 2026 – Daily CyberSecurity
• Critical Vulnerability in Atlassian Data Center Products – CSA Singapore
• Atlassian security advisory AV26-1002 – Canadian Centre for Cyber Security
• Atlassian CVE-2026-21589 – IT-Connect

Featured image: Photo: “Mediq Utrecht Data center Gwan Kho” by Gwan Kho, CC BY-SA 2.0, via Openverse — source