---
title: Atlassian Data Center: CVE-2026-21589 in 72 hours | ctxsec
url: https://ctxsec.com/playbooks/atlassian-dc-cve-2026-21589
---

[← Playbooks](/playbooks)

# Atlassian Data Center: CVE-2026-21589 in 72 hours

Patch-or-isolate path for the KEV-listed unauthenticated file read in Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center (federal due date Oct 18, 2026). Based on Atlassian's advisory.

For: Security lead, Sysadmin, Atlassian admin

[1. Find every instance](#s1)[2. Cut exposure first](#s2)[3. Apply the stopgap rule](#s3)[4. Patch node by node](#s4)[5. Look back for compromise](#s5)[6. Close out](#s6)

-

Step 1 of 6

__

### Find every instance

Every Data Center version of the listed products is affected, so start with an inventory, not a version check.

- List Jira, JSM, Confluence, Bitbucket (including mirrors and mirror farms), Bamboo, Crowd, Crucible and Fisheye nodes
- Mark which are reachable from the internet, directly or through a reverse proxy
- Note the current version of each one and the fixed LTS build you'll move it to
-

Step 2 of 6

__

### Cut exposure first

Atlassian says to take instances off the internet until they're patched or mitigated, even ones that require login.

- Put internet-facing instances behind a VPN or an IP allowlist
- Confirm from outside that they're no longer reachable
-

Step 3 of 6

__

### Apply the stopgap rule

If patching has to wait, block '..' next to /, \ or :: at the edge or inside Tomcat.

- Add Atlassian's regex as a WAF or proxy rule, or
- Enable Tomcat RewriteValve with the rewrite.config rule (Confluence, Jira, JSM, Bamboo, Crowd), or add the urlrewrite.xml rule (Bitbucket, on every node and mirror)
- Test that encoded forms like %2e%2e%2f and %252e%252e are blocked
-

Step 4 of 6

__

### Patch node by node

Fixed builds: Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, Jira 9.12.40/10.3.26/11.3.12, JSM 5.12.40/10.3.26/11.3.12, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Crucible and Fisheye 4.9.15.

- Back up each node before upgrading
- Upgrade every cluster node, not just the one behind the load balancer
- Record the version you end on
-

Step 5 of 6

__

### Look back for compromise

Atlassian can't tell you whether you were hit. CISA flagged this KEV entry for forensic triage.

- Search access logs back to at least Oct 5 (decode the URL up to twice, then look for .. next to /, \ or ::)
- Treat unauthenticated requests that got a 200 as possible file exposure
- Rotate any secrets stored in files under the webapp root if you find hits
-

Step 6 of 6

__

### Close out

Write down what you did so the next KEV deadline is faster.

- Confirm the mitigation rule stays in place until every node is patched
- Record the patch date and evidence for each instance
- Remove temporary allowlists only after patching is verified

Original content by ctxsec. Printable checklist: use your browser's print view.