Affected Systems

Atlassian self-hosted Data Center products: Confluence (< 9.2.26, 10.2.19), Jira Software/Service Management (< 9.12.40, 10.3.26, 11.3.12), Bitbucket (< 9.4.26, 10.2.8, 10.5.1), Bamboo (< 10.2.24, 12.1.12), Crowd (< 6.3.7, 7.0.3, 7.1.7, 7.2.4), Crucible/Fisheye (< 4.9.15). Cloud instances are not affected.

Exploitation Status

No active exploitation observed. Atlassian reports no evidence of attacks in the wild. Exploitation requires prior knowledge of exact file names and paths; directory enumeration is not possible.

Business Impact

Unauthenticated attackers can read arbitrary files within the web application root directory if they know exact file names and paths. Risk includes exposure of configuration files, credentials, session tokens, or application source code. Self-hosted instances are at risk; cloud customers are already patched. Atlassian cannot determine if individual instances have been compromised, requiring local log review.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Apply vendor patches immediately for all affected Atlassian Data Center products (Confluence 9.2.26/10.2.19+, Jira 9.12.40/10.3.26/11.3.12+, Bitbucket 9.4.26/10.2.8/10.5.1+, Bamboo 10.2.24/12.1.12+, Crowd 6.3.7/7.0.3/7.1.7/7.2.4+, Crucible/Fisheye 4.9.15+)
  • Review access logs for path traversal patterns (e.g., ../, encoded traversal sequences) across all affected products to detect potential exploitation attempts
  • If patching is delayed, implement WAF or proxy rules blocking traversal patterns, or deploy Tomcat RewriteValve rules (Confluence, Jira, Bamboo, Crowd) or URL rewrite rules (Bitbucket) per Atlassian advisory
  • Restrict external network access to self-hosted instances, especially internet-facing deployments, until patches are applied
  • Ensure mitigations are deployed to all cluster nodes, including Bitbucket mirrors and mirror farm nodes