---
title: Tip: if you can't upgrade Jira/Confluence by Oct 18, isolate it or block '..' at the proxy | ctxsec
url: https://ctxsec.com/items/tip-atlassian-21589-72h
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-atlassian-21589-72h.md)

how-to

2026-10-15

### Tip: if you can't upgrade Jira/Confluence by Oct 18, isolate it or block '..' at the proxy

The KEV due date for CVE-2026-21589 is three days out. Fastest safe order: (1) restrict internet access to the Data Center instance (VPN or allowlist), (2) push Atlassian's regex rule to whatever fronts it (Cloudflare, AWS WAF, nginx, F5) and test it against encoded variants such as `%2e%2e%2f` and `%252e`, (3) schedule the fixed LTS build node by node. Remember Bitbucket mirrors and mirror-farm nodes need the urlrewrite rule too, and Crowd's `server.xml` may live under `Catalina/localhost/crowd.xml`.

Sources: [Atlassian advisory: CVE-2026-21589](https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html)