Vulnerabilities
Atlassian Data Center Vulnerability CVE‑2026‑21589 Enables Unauthenticated File Access
Atlassian has disclosed CVE‑2026‑21589, a critical arbitrary file‑access flaw in self‑hosted Data Center editions of Jira, Confluence, Bitbucket, and other products. The flaw allows unauthenticated attackers to read specific files in the web root if they know the exact path. All versions prior to the listed patches must be updated immediately.
What happened
Atlassian identified a critical vulnerability (CVE‑2026‑21589) that permits unauthenticated users to read arbitrary files from the web root of affected Data Center applications. The flaw requires knowledge of the file name and path but does not allow directory enumeration.
Impact
Products affected include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, and Crucible. Versions before Bitbucket DC 9.4.26, 10.2.8, 10.5.1; Confluence DC 9.2.26, 10.2.19; Jira SM DC 5.12.40, 10.3.26, 11.3.12; Jira Software DC 9.12.40, 10.3.26, 11.3.12; Bamboo DC 10.2.24, 12.1.12; Crowd DC 6.3.7, 7.0.3, 7.1.7, 7.2.4; Crucible 4.9.15. The vulnerability could expose configuration files, credentials, or other sensitive data if the attacker knows the path.
What to do
- Verify deployment version and compare against the patch list.
- Apply the latest Data Center update for the affected product immediately.
- Restrict web root access by implementing firewall rules or reverse‑proxy restrictions to limit exposure.
- Audit logs for unexpected file read requests and monitor for suspicious activity.
- Consider enabling Atlassian’s security hardening guidelines and least‑privilege access controls.
Mitigation
Atlassian recommends installing the specific patch versions listed above. No configuration change alone will mitigate the flaw; an update is required.
Related vulnerabilities
Atlassian Data Center Vulnerability CVE-2026-21589 Exploited Within Hours of Disclosure
A critical flaw (CVSS 9.3) in Atlassian’s self-hosted Data Center suite—affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye—was actively targeted by attackers just days after the PoC was published. The vulnerability allows unauthenticated remote access to specific files in the web root, requiring exact file names and paths. All affected versions now have patches; defenders should verify deployment and monitor for suspicious file-access activity.
Read briefing
Atlassian Data Center Vulnerability CVE‑2026‑21589 Enables Unauthenticated File Read Across 8 Products
A critical path‑traversal flaw (CVE‑2026‑21589) in eight Atlassian Data Center products allows unauthenticated users to read known files in the web‑application root. The issue is fixed in specific versions; unpatched instances should be taken offline or blocked until upgraded.
Read briefing
Atlassian CVE-2026-21589: Arbitrary File Access Vulnerability Exploited in Production
On Oct 5 Atlassian released patches for CVE‑2026‑21589, a directory‑traversal flaw that lets attackers read files inside the web‑app directory via a ‘::’ escape sequence. Recent honeypot scans show active exploitation attempts. Defenders should patch immediately, verify file‑access controls, and monitor for suspicious download URLs.
Read briefing
CISA Adds CVE-2026-21589 to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-21589, a file and directory disclosure flaw in multiple Atlassian products, to its Known Exploited Vulnerabilities catalog. Federal agencies must prioritize patching and verify that exposed assets are not compromised. All organizations should adopt risk‑based remediation for KEV entries.
Read briefing