Confluence & Jira Checker.
Atlassian fixed a critical arbitrary file access flaw in its self-hosted Data Center products (CVSS 9.3) and CISA lists it as exploited. Check which version your Confluence, Jira or Bitbucket runs and whether it is before the fix.
Passive check on servers you own. It reads the public sign-in page and the public application manifest like a browser, never logs in and never sends an exploit. Atlassian Cloud is already patched; every earlier Data Center version is affected (Atlassian, 5 Oct 2026).
Why CVE-2026-21589 Matters.
Your Wiki And Tickets Hold Your Secrets
Confluence, Jira and Bitbucket collect design documents, credentials pasted into tickets, customer data and source code. A flaw that lets a visitor read files from the server puts all of that in reach, which is why CVE-2026-21589 is rated CVSS 9.3.
Already On The Exploited List
Atlassian published the advisory on 5 October 2026 and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 15 October 2026. Once attacks are on record, an unpatched server is a target, not a risk on paper.
Hidden Does Not Mean Patched
Single sign-on, a firewall or a reverse proxy can hide a version from an outside check. Read the real version as an administrator rather than assuming a quiet page means a safe server.
Only Servers You Run Are At Risk
Atlassian Cloud is already patched. Data Center and Server products are installed and upgraded by your own team, so the fix is yours to apply, and release lines older than the supported ones get no fix at all.
How The Check Works.
- 01
Enter Your Server
Type the domain, IP, or URL of a Confluence, Jira or Bitbucket you run. The check reaches the public sign-in page exactly as a browser would.
- 02
Run The Check
We read the version the sign-in page and the public application manifest print, then compare it with the CVE-2026-21589 fixed versions. No login, no API token, no exploit.
- 03
Read The Verdict
See the product and version we recognised, whether it is before the fix of its release line, and a clear next step. If the version cannot be read we say so plainly and tell you where to look.
FAQ
Common Questions.
CVE-2026-21589 is an arbitrary file access flaw in Atlassian's self-hosted Data Center and Server products, rated Critical with a CVSS 4.0 score of 9.3. Atlassian published the advisory on 5 October 2026. CISA added it to its Known Exploited Vulnerabilities catalog on 15 October 2026, which means attacks in the wild are on record. Atlassian Cloud sites are already patched; the risk is for servers your own team runs.
Confluence, Jira, Jira Service Management, Bitbucket, Bamboo and Crowd Data Center, plus Fisheye and Crucible. Atlassian lists every earlier version as affected. Fixed versions: Confluence 9.2.26 and 10.2.19; Jira 9.12.40, 10.3.26 and 11.3.12; Bitbucket 9.4.26, 10.2.8 and 10.5.1; Bamboo 10.2.24 and 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 and 7.2.4; Fisheye and Crucible 4.9.15. A release line with no fix of its own, such as a Jira feature release below 11.3, is affected until you move to a fixed line.
Atlassian servers print their version to anonymous visitors by design: in the sign-in page, in the footer of Bitbucket, and in a public application-link manifest that every product serves so that products can link to each other. The check reads those, as a browser or a linked product would, and compares the exact version with the fixed versions. When none of them is readable, it says so instead of guessing.
It makes ordinary GET requests for the home page of the address you enter (HTTPS first, HTTP if that fails) and for the public application manifest. If you enter a bare domain and nothing on it is Atlassian, it also looks at jira., confluence., bitbucket., stash. and wiki. in front of that domain, and at the /jira, /confluence and /bitbucket paths. It never logs in, never sends an exploit and never asks for a file from the web root. Only check servers you are authorised to test.
No. Atlassian patched its Cloud sites (addresses ending in atlassian.net). The advisory applies to Data Center and Server products that your own team installs and upgrades.
No. A server behind single sign-on, a firewall or a reverse proxy that strips pages can hide its version, and a hidden version is not a patched version. Sign in as an administrator and open the About page of the product, then compare the version with the fixed versions above.
Atlassian's advisory lists workarounds: a web application firewall rule, a Tomcat rewrite rule, and for Bitbucket a rewrite rule in its urlrewrite configuration. They reduce the risk but are not a fix, so upgrade to the fixed version of your line as soon as you can. Until then, keep the server off the open internet if you can, for example behind a VPN or an IP allow list.
Related checks: GitLab checker and PHP2Shell checker.
One Server Checked. See Your Whole Edge.
This tool reads one server's version. The Brandefense platform inventories every internet-facing system you run, flags new CVEs as they land, and keeps watch over your external attack surface without a break.
Request A Demo