Atlassian CVE-2026-21589: a file by its known name, with no login and no directory listing

The Atlassian advisory of 5 October describes CVE-2026-21589 without extra drama and without softening it. No login is required. A specific file inside the web application root can be read if its name and path are already known. This bug does not hand over a directory listing. Atlassian scores it 9.3. They have already fixed the cloud products and say they found no evidence of exploitation there. A Data Center instance you run does not inherit the cloud patch.

What to update

• Jira Software Data Center: 9.12.40, 10.3.26, or 11.3.12.
• Jira Service Management: 5.12.40, 10.3.26, or 11.3.12.
• Confluence Data Center: 9.2.26 or 10.2.19.
• Bitbucket Data Center: 9.4.26, 10.2.8, or 10.5.1.
• Bamboo: 10.2.24 or 12.1.12. Crowd: 6.3.7, 7.0.3, 7.1.7, or 7.2.4. Crucible and Fisheye: 4.9.15.

We are not going to guess file names in this note: the advisory says the risk is higher where something secret sits inside the application root. The sane response is to move such files out of that directory and install the build for your branch. An instance published on the internet "so a contractor can get in" goes first. CERT-EU also asks people to read access logs, not only the version number.