Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN970 _____________________________________________________________________ DATE : 06/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Fisheye . ==================================================================== https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html _____________________________________________________________________ CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products Related content Multiple Products Security Advisory - Log4j Vulnerable To Remote Code Execution - CVE-2021-44228 FAQ for CVE-2022-22965 FAQ for CVE-2022-26136 / CVE-2022-26137 FAQ for CVE-2023-22527 Sourcetree Security Advisory 2018-01-24 FAQ for CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105 Tracking Resolution of Issue Described in FAQ for CVE-2022-22965 FAQ for CVE-2022-36804 FAQ for CVE-2023-22522 Multiple Products Security Advisory - Hazelcast Vulnerable To Remote Code Execution - CVE-2016-10750 Summary CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products Advisory Release Date 05 Oct 2026 Products Bitbucket Data Center Confluence Data Center Jira Service Management Data Center Jira Software Data Center Bamboo Data Center Crowd Data Center Crucible Fisheye CVE ID CVE-2026-21589 Related Jira Ticket(s) BSERV-20604 CONFSERVER-104488 JSDSERVER-16809 JRASERVER-79546 BAM-26567 CWD-6610 CRUC-8741 FE-7583 Summary of Vulnerability All versions of Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye are affected by this vulnerability. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be sensitive files present that increase your risk. All Data Center products listed below are at risk and require immediate attention. See “What You Need to Do” for detailed instructions. Affected Atlassian Cloud products have been patched, and our investigation has not found evidence of exploitation. No Cloud customer action is required. Severity Atlassian rates the severity level of this vulnerability as Critical (9.3 with the following vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H) per our internal assessment. This is our assessment, and you should evaluate its applicability to your own IT environment. Affected Versions This Arbitrary File Access vulnerability affects all versions prior to the listed fix versions of affected Products. Atlassian recommends patching to the fixed LTS version or later. Product Affected Versions Bitbucket Data Center Confluence Data Center Jira Service Management Data Center Jira Software Data Center Bamboo Data Center Crowd Data Center Crucible Fisheye All versions are affected What You Need To Do Immediately patch to a fixed version Atlassian recommends that you patch each of your affected installations to fixed versions or the latest version. Product Fixed Versions Bitbucket Data Center 9.4.26 10.2.8 10.5.1 Confluence Data Center 9.2.26 10.2.19 Jira Service Management Data Center 5.12.40 10.3.26 11.3.12 Jira Software Data Center 9.12.40 10.3.26 11.3.12 Bamboo Data Center 10.2.24 12.1.12 Crowd Data Center 6.3.7 7.0.3 7.1.7 7.2.4 Crucible 4.9.15 Fisheye 4.9.15 Apply temporary mitigations if unable to patch Remove your instance from the internet until you can patch or apply mitigations, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can take action. Option 1: Apply a Web Application Firewall Rule, requires regex filtering (For All Affected Products) Apply a rule, described below, to your Web Application Firewall or proxy layer. Rule implementation instructions are dependent on your technology (e.g. reverse proxy, AWS WAF, or Cloudflare). Block any URL containing this regex pattern regex filter (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* The intent of this regex is to block .. immediately adjacent to /, \, or ::. Test that your rule blocks .. immediately adjacent to /, \, or :: and handles the URL-encoded patterns Option 2: Block requests using Tomcat’s RewriteValve (For Confluence, JSM, Jira, Bamboo, and Crowd) First, back up your instance. Then, for each node in your Data Center cluster: Shut down the node Enable Tomcat’s RewriteValve: Locate the server.xml file: On Confluence, JSM, Jira, and Bamboo: conf/server.xml On Crowd: either apache-tomcat/conf/Catalina/localhost/crowd.xml or apache-tomcat/conf/server.xml, whichever has your application (see below) Make a copy of this file as a backup Inside this file identify the element representing the application, the docBase attribute will be a path including the product name; in the standard setup this will be the only element Add the following line within that element if it is not already there: Install the configuration: Locate the WEB-INF directory: On Confluence: confluence/WEB-INF On JSM/Jira: atlassian-jira/WEB-INF On Bamboo: bamboo/WEB-INF or atlassian-bamboo/WEB-INF On Crowd: crowd-webapp/WEB-INF Within this directory, check if the file rewrite.config exists If it exists: Make a copy of the existing rewrite.config file as a backup Append the existing file with the rewrite.config code block provided below If it does not exist: Create a rewrite.config file in the directory with the code block provided below Restart the node rewrite.config # Primary check: Tomcat's decoded, normalized request path (no query string). RewriteCond %{REQUEST_PATH} (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* RewriteRule (?s)^.*$ /?denied [F,L] # Raw-URI fallback RewriteCond %{REQUEST_URI} (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* RewriteRule (?s)^.*$ /?denied [F,L] Option 3: Add rule to urlrewrite.xml (For Bitbucket only) First, back up your instance. For a clustered system, this patch should be applied to all nodes. Similarly, apply the patch to all Bitbucket mirrors and Bitbucket mirror farm nodes. Edit the /app/WEB-INF/urlrewrite.xml file Add a new to the top of the file, before other s (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* 404 /mvc/error404 When the mitigation is applied, the top of the urlrewrite.xml file should look like the below: (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* 404 /mvc/error404 [...] Restart Bitbucket Data Center Threat detection Atlassian cannot confirm if your instances have been affected by this vulnerability. You should engage your local security team to check all affected instances for evidence of compromise. Paths for investigating evidence of compromise in your access logs: URL-decode each access-log request line (up to two decoding passes) before searching, then check for .. immediately adjacent to /, \, or ::; or Search raw (non-decoded) log lines directly using the regex above Support If you did not receive an email for this advisory, and you wish to receive such emails in the future go to https://my.atlassian.com/email and subscribe to Alerts emails. If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/. References Security Bug Fix Policy As per our new policy critical security bug fixes will be back ported. We will release new maintenance releases for the versions covered by the policy instead of binary patches. Binary patches are no longer released. Security Levels for Security Issues Atlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry standard vulnerability metric. You can also learn more about CVSS at FIRST.org. End of Life Policy Our end of life policy varies for different products. Please refer to our EOL Policy for details. Links For a full description of the latest versions, see the release notes for your product below. Bitbucket Data Center Confluence Data Center Jira Service Management Data Center Jira Software Data Center Bamboo Data Center Crowd Data Center Crucible Fisheye You can download the latest version for your product from the download center: Bitbucket Data Center Confluence Data Center Jira Service Management Data Center Jira Software Data Center Bamboo Data Center Crowd Data Center Crucible Fisheye Last modified on Oct 5, 2026 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================