Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flaw

Anyone who can reach an affected instance over the network can attempt this, because no account is needed ^[1]. Atlassian's CVE record classes it as a path traversal, where a request uses a specially built file path to reach files it should not ^[3]. How much an attacker gets depends on what sits in the web application root, the folder that holds the application itself. Atlassian says that folder may contain sensitive files in some configurations ^[11].

For exposed hosts, the emergency-patch reading holds. Atlassian's restriction advice covers any instance reachable from the public internet, including one that requires a login, and it runs until the host is upgraded or a blocking rule is in place ^[5]. The affected range is every version before each product's fix and may include end-of-life releases. Atlassian recommends moving to a fixed long-term support version or later ^[16].

The stopgaps carry their own downtime. The Tomcat RewriteValve rule for Confluence, Jira Software, Jira Service Management, Bamboo and Crowd goes on each node, and each node must be shut down and restarted. Bitbucket's urlrewrite.xml change goes on every node, mirror and mirror farm node, followed by a restart ^[7]. Six of the 8 products therefore need restarts to take an in-application rule ^[21]. Crucible and Fisheye can only use the rule on a web application firewall or reverse proxy ^[8]. Atlassian says the mitigations "are limited and not a replacement for patching your instance" ^[24].

Version checks need care. For Crowd, the CVE record lists 7.1.1, a release Atlassian's notes date to November 27, 2025, more than 10 months before disclosure ^[18]. Atlassian's Crowd ticket gives 7.1.7 in its fix version field, while a table in the same ticket shows 7.1.6, a version the ticket also lists as affected ^[17]. For Bamboo, one field in the record says 10.2.4 and its description says 10.2.24 ^[19].

Server customers have fewer options. Crowd has had no Server release since 5.2 in September 2023, so none of the fixed Crowd versions are Server builds ^[23]. For Jira Software Server the record lists 9.12.40 and later as unaffected, for Jira Service Management Server 5.12.40, and for Crucible and Fisheye Server 4.9.15 ^[22].

Atlassian says its investigation has not found evidence of exploitation ^[10]. On self-hosted instances it goes no further. "Atlassian cannot confirm if your instances have been affected by this vulnerability," the advisory says ^[12]. The log hunt it describes is to URL-decode each request line up to two times and look for the same .. patterns, or to run the block pattern over raw log lines ^[13]. The advisory does not explain how to tell a failed attempt from a request that returned a file ^[14].

This class of bug has been exploited in Atlassian software before. CVE-2021-26086 was a path traversal in Jira ^[25]. For CVE-2026-21589, the public record so far is a disclosure on October 5 and a list of fixed versions dated October 6 ^[2][15].