Vulnerabilities
Atlassian Data Center Vulnerability CVE‑2026‑21589 Enables Unauthenticated File Read Across 8 Products
A critical path‑traversal flaw (CVE‑2026‑21589) in eight Atlassian Data Center products allows unauthenticated users to read known files in the web‑application root. The issue is fixed in specific versions; unpatched instances should be taken offline or blocked until upgraded.
What happened
Atlassian disclosed a critical path‑traversal flaw (CVE‑2026‑21589) that permits unauthenticated users to read any file whose full path is known within the web‑application root of eight Data Center products. The vulnerability does not allow directory enumeration.
Impact
Any instance that is reachable from the public internet and hosts the affected products could expose configuration files, credentials, or other sensitive data if an attacker knows a file’s location. Cloud deployments are already patched; on‑premises customers must act.
Affected products and fixed versions
- Bitbucket Data Center – 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center – 9.2.26, 10.2.19
- Jira Software Data Center – 9.12.40, 10.3.26, 11.3.12
- Jira Service Management Data Center – 5.12.40, 10.3.26, 11.3.12
- Bamboo Data Center – 10.2.24, 12.1.12
- Crowd Data Center – 6.3.7, 7.0.3, 7.1.7, 7.2.4
- Crucible – 4.9.15
- Fisheye – 4.9.15
Mitigation steps
• Upgrade to the listed fixed versions or a later LTS release.
• If an upgrade is not immediately possible, take the instance offline or restrict inbound traffic with a firewall rule until the patch is applied.
• Verify that the web‑application root does not contain sensitive files; if it does, consider moving them outside the root or applying strict file‑system permissions.
Related vulnerabilities
Atlassian Data Center Vulnerability CVE‑2026‑21589 Enables Unauthenticated File Access
Atlassian has disclosed CVE‑2026‑21589, a critical arbitrary file‑access flaw in self‑hosted Data Center editions of Jira, Confluence, Bitbucket, and other products. The flaw allows unauthenticated attackers to read specific files in the web root if they know the exact path. All versions prior to the listed patches must be updated immediately.
Read briefing
Atlassian Data Center Vulnerability CVE-2026-21589 Exploited Within Hours of Disclosure
A critical flaw (CVSS 9.3) in Atlassian’s self-hosted Data Center suite—affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye—was actively targeted by attackers just days after the PoC was published. The vulnerability allows unauthenticated remote access to specific files in the web root, requiring exact file names and paths. All affected versions now have patches; defenders should verify deployment and monitor for suspicious file-access activity.
Read briefing
Atlassian CVE-2026-21589: Arbitrary File Access Vulnerability Exploited in Production
On Oct 5 Atlassian released patches for CVE‑2026‑21589, a directory‑traversal flaw that lets attackers read files inside the web‑app directory via a ‘::’ escape sequence. Recent honeypot scans show active exploitation attempts. Defenders should patch immediately, verify file‑access controls, and monitor for suspicious download URLs.
Read briefing
CISA Adds CVE-2026-21589 to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-21589, a file and directory disclosure flaw in multiple Atlassian products, to its Known Exploited Vulnerabilities catalog. Federal agencies must prioritize patching and verify that exposed assets are not compromised. All organizations should adopt risk‑based remediation for KEV entries.
Read briefing