Confluence Data Center

This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be sensitive files present that increase your risk.

Confluence Data Center versions as listed below are at risk and require immediate attention. See ‘What You Need to Do’ for detailed instructions.

Affected Atlassian Cloud products have been patched, and our investigation has not found any evidence of exploitation. No Cloud customer action is required.

This critical severity Arbitrary File Access vulnerability known as CVE-2026-21589 affects all versions prior to the listed fix versions of Confluence Data Center. Versions outside of the support window (i.e. versions that have reached End of Life) may also be affected, so Atlassian recommends you upgrade to a fixed LTS version or later.

Immediately patch to a fixed version

Atlassian recommends that you upgrade your instance to one of the versions listed in the “Fixed Versions” table section of this ticket. For full descriptions of the above versions of Confluence Data Center, see the release notes . You can download the latest version of Confluence Data Center from the download center .

Apply temporary mitigations if unable to patch

Remove your instance from the internet until you can patch or apply mitigations, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can take action.

Option 1: Apply a Web Application Firewall Rule, requires regex filtering

Apply a rule, described below, to your Web Application Firewall or proxy layer. Rule implementation instructions are dependent on your technology (e.g. reverse proxy, AWS WAF, or Cloudflare).

Block any URL containing this regex pattern (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* The intent of this regex is to block .. immediately adjacent to /, \, or :: .

The intent of this regex is to block .. immediately adjacent to /, \, or :: .

Test that your rule blocks .. immediately adjacent to \, /, or :: and handles the URL-encoded patterns

Option 2: Block requests using Tomcat’s RewriteValve

First, back up your instance. Then, for each node in your Data Center cluster:

Enable Tomcat’s RewriteValve: Locate the server.xml file: On Confluence: conf/server.xml Make a copy of this file as a backup Inside this file identify the element representing the application, the docBase attribute will be a path including the product name; in the standard setup this will be the only element Add the following line within that element if it is not already there:

Locate the server.xml file: On Confluence: conf/server.xml

On Confluence: conf/server.xml

Make a copy of this file as a backup

Inside this file identify the element representing the application, the docBase attribute will be a path including the product name; in the standard setup this will be the only element

Add the following line within that element if it is not already there:

Install the configuration: Locate the WEB-INF directory: On Confluence: confluence/WEB-INF Within the directory, check if the file rewrite.config exists If it exists: Make a copy of the existing rewrite.config file as a backup Append the existing file with the content of rewrite.config If it does not exist: Put attached rewrite.config file in the directory

Locate the WEB-INF directory: On Confluence: confluence/WEB-INF

On Confluence: confluence/WEB-INF

Within the directory, check if the file rewrite.config exists

If it exists: Make a copy of the existing rewrite.config file as a backup Append the existing file with the content of rewrite.config

Make a copy of the existing rewrite.config file as a backup

Append the existing file with the content of rewrite.config

If it does not exist: Put attached rewrite.config file in the directory

Put attached rewrite.config file in the directory

Note: These mitigation actions are limited and not a replacement for patching your instance; you must patch as soon as possible

Sort By Name Sort By Date Ascending Descending Thumbnails List

Sort By Name Sort By Date Ascending Descending Thumbnails List

rewrite.config 0.5 kB 02/Oct/2026 4:33 PM