[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Playbooks

Atlassian Data Center: CVE-2026-21589 in 72 hours

Patch-or-isolate path for the KEV-listed unauthenticated file read in Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center (federal due date Oct 18, 2026). Based on Atlassian's advisory.

For: Security lead, Sysadmin, Atlassian admin

1. Find every instance2. Cut exposure first3. Apply the stopgap rule4. Patch node by node5. Look back for compromise6. Close out
  1. Step 1 of 6

    Find every instance

    Every Data Center version of the listed products is affected, so start with an inventory, not a version check.

    • List Jira, JSM, Confluence, Bitbucket (including mirrors and mirror farms), Bamboo, Crowd, Crucible and Fisheye nodes
    • Mark which are reachable from the internet, directly or through a reverse proxy
    • Note the current version of each one and the fixed LTS build you'll move it to
  2. Step 2 of 6

    Cut exposure first

    Atlassian says to take instances off the internet until they're patched or mitigated, even ones that require login.

    • Put internet-facing instances behind a VPN or an IP allowlist
    • Confirm from outside that they're no longer reachable
  3. Step 3 of 6

    Apply the stopgap rule

    If patching has to wait, block '..' next to /, \ or :: at the edge or inside Tomcat.

    • Add Atlassian's regex as a WAF or proxy rule, or
    • Enable Tomcat RewriteValve with the rewrite.config rule (Confluence, Jira, JSM, Bamboo, Crowd), or add the urlrewrite.xml rule (Bitbucket, on every node and mirror)
    • Test that encoded forms like %2e%2e%2f and %252e%252e are blocked
  4. Step 4 of 6

    Patch node by node

    Fixed builds: Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, Jira 9.12.40/10.3.26/11.3.12, JSM 5.12.40/10.3.26/11.3.12, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Crucible and Fisheye 4.9.15.

    • Back up each node before upgrading
    • Upgrade every cluster node, not just the one behind the load balancer
    • Record the version you end on
  5. Step 5 of 6

    Look back for compromise

    Atlassian can't tell you whether you were hit. CISA flagged this KEV entry for forensic triage.

    • Search access logs back to at least Oct 5 (decode the URL up to twice, then look for .. next to /, \ or ::)
    • Treat unauthenticated requests that got a 200 as possible file exposure
    • Rotate any secrets stored in files under the webapp root if you find hits
  6. Step 6 of 6

    Close out

    Write down what you did so the next KEV deadline is faster.

    • Confirm the mitigation rule stays in place until every node is patched
    • Record the patch date and evidence for each instance
    • Remove temporary allowlists only after patching is verified

Original content by ctxsec. Printable checklist: use your browser's print view.