How to find Atlassian products on your network

Critical Atlassian disclosure: CVE-2026-21589 #

Update (October 16, 2026): Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 15, 2026.

Atlassian disclosed that certain versions of Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Software, and Jira Service Management contain an arbitrary file access vulnerability that allows an unauthenticated, remote attacker to access specific files within the web application root directory. Exploitation requires prior knowledge of the target file's exact name and path; the vulnerability does not allow an attacker to enumerate or list directory contents. In some configurations, sensitive files may be reachable this way, increasing the impact of exploitation. Atlassian Cloud sites have been patched and Atlassian's investigation found no evidence of exploitation against Cloud. This vulnerability has been designated CVE-2026-21589 and has been rated critical with a CVSS score of 9.3.

The following versions are affected:

• Bamboo Data Center: All versions prior to 10.2.24 or 12.1.12.
• Bitbucket Data Center: All versions prior to 9.4.26, 10.2.8, or 10.5.1.
• Confluence Data Center: All versions prior to 9.2.26 or 10.2.19.
• Crowd Data Center: All versions prior to 6.3.7, 7.0.3, 7.1.7, or 7.2.4.
• Crucible: All versions prior to 4.9.15.
• Fisheye: All versions prior to 4.9.15.
• Jira Software Data Center: All versions prior to 9.12.40, 10.3.26, or 11.3.12.
• Jira Service Management Data Center: All versions prior to 5.12.40, 10.3.26, or 11.3.12.

What are Atlassian Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Software, and Jira Service Management? #

Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Software, and Jira Service Management are Atlassian's self-managed products for CI/CD, source control, collaboration, identity, code review, and issue tracking.

What is the impact? #

Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to read arbitrary files within the web application root directory, potentially leading to the exposure of sensitive configuration data or credentials.

Are any updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

• Bamboo Data Center: Upgrade to version 10.2.24, 12.1.12, or later.
• Bitbucket Data Center: Upgrade to version 9.4.26, 10.2.8, 10.5.1, or later.
• Confluence Data Center: Upgrade to version 9.2.26, 10.2.19, or later.
• Crowd Data Center: Upgrade to version 6.3.7, 7.0.3, 7.1.7, 7.2.4, or later.
• Crucible: Upgrade to version 4.9.15 or later.
• Fisheye: Upgrade to version 4.9.15 or later.
• Jira Software Data Center: Upgrade to version 9.12.40, 10.3.26, 11.3.12, or later.
• Jira Service Management Data Center: Upgrade to version 5.12.40, 10.3.26, 11.3.12, or later.

Workaround:

• If you are unable to patch immediately, remove the instance from the internet or apply a Web Application Firewall (WAF) rule to block requests with URLs containing ".." immediately adjacent to "/", "\", or "::" (including URL-encoded variants).
• Atlassian has also published product-specific Tomcat RewriteValve mitigations in each advisory.

Finding exposed Atlassian installations with runZero #

From the Software Inventory, use the following query to locate potentially impacted installations:

vendor:=Atlassian AND (product:=Confluence OR product:=Jira OR product:=Bitbucket OR product:=Crowd OR product:=Bamboo OR product:=Fisheye) AND source:runzero

Note: This query does not currently detect Crucible instances.

February 2025: #

Atlassian issued a security bulletin for high and critical vulnerabilities found within third-party dependencies used within their products. The affected products include: Bamboo, Bitbucket, Confluence, Crowd, and JIRA.

Three of the critical vulnerabilities were found within the embedded Apache Tomcat web server. The first two: CVE-2024-50379,  CVE-2024-56337 with a CVSS score of 9.8, affects Confluence Data Center and Server as well as Crowd Data Center and Server with the potential for a remote attacker to execute arbitrary code. CVE-2024-52316, also with a CVSS score of 9.8, affects Crowd Data Center and Server, potentially allows for an authentication bypass by a remote attacker.

One high vulnerability found within the protocol buffer library CVE-2024-7254, with a CVSS score of 8.7, affects Bamboo Data Center and Server in addition to Jira Data Center and Server, potentially leading to a denial of service (DoS).

Another high vulnerability found with the Avro serialization library CVE-2024-47561, with a CVSS score of 7.3, affects Bitbucket Data Center and Server potentially allowing for a remote attacker to execute arbitrary code.

What is the impact? #

Bamboo, Crowd, and JIRA are vulnerable to denial of service vulnerabilities. Bitbucket, Confluence, and Crowd are vulnerable to unauthenticated remote execution of arbitrary code by a remote attacker. Crowd is also vulnerable to a broken authentication vulnerability.

Atlassian has indicated that there are no known active exploitations of the of the vulnerabilities. However, they recommend updating to the latest software revisions as soon as possible.

Are updates available? #

Updates are available and detailed within the security bulletin.

How do I find potentially vulnerable instances with runZero? #

From the Service Inventory, use the following query to locate systems running potentially vulnerable software:

(product:confluence OR (_asset.protocol:http AND protocol:http AND has:http.head.xConfluenceRequestTime)) OR (product:bamboo OR (_asset.protocol:http AND protocol:http AND _service.favicon.ico.image.mmh3:=-1379982221)) OR (product:bitbucket OR (_asset.protocol:http AND protocol:http AND _service.favicon.ico.image.mmh3:=667017222)) OR (product:crowd OR (_asset.protocol:http AND protocol:http AND _service.favicon.ico.image.mmh3:=-1231308448)) OR (product:jira OR (_asset.protocol:http AND protocol:http AND (_service.favicon.ico.image.mmh3:=628535358 OR _service.favicon.ico.image.mmh3:=855273746)))