Atlassian’s Critical Flaw Turns Eight Enterprise Products Into One Big Security Problem
The 9.3-rated flaw lets unauthenticated attackers reach specific files, and Atlassian says cloud customers are already patched.
- On Monday, Atlassian urged administrators to patch CVE-2026-21589, a critical vulnerability affecting self-hosted Data Center products. The company sent an email titled "Action required" directing users to a security bulletin detailing the flaw.
- The 9.3-rated arbitrary file access vulnerability impacts self-hosted versions of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated attackers can access specific files within the web application root directory in affected versions.
- Exploitation requires attackers to know the exact filename and path; the flaw does not allow directory listing. Atlassian reported no evidence of current attacks but advises administrators to review access logs for traversal patterns.
- System administrators unable to patch immediately should restrict external network access or add web application firewall rules. Atlassian provided step-by-step instructions for implementing mitigations across all cluster nodes, including Bitbucket mirrors and mirror farm nodes.
- Users who transitioned to Atlassian Cloud remain unaffected, as the company has already patched its SaaS environments. This reinforces Atlassian's strategy to discontinue self-hosted Data Center software in favor of cloud-based services.
20 Articles
20 Articles
BleepingComputer
cybernoz.comAtlassian warns of critical file-access flaw in Jira, Confluence
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket.
CSO Online
Atlassian’s critical flaw turns eight enterprise products into one big security problem
A newly-disclosed critical flaw in Atlassian’s data center software has a remarkably wide reach, affecting eight core products across the company’s enterprise portfolio. CVE-2026-21589, rated 9.3 (critical) in severity, is an arbitrary file access vulnerability that could allow an attacker with no login access to read files in web app root directories that they should not otherwise see, and potentially use them for nefarious purposes. The impact…
The Register
IT Security News - cybersecurity, infosecurity newsAtlassian warns of critical file access flaw in its datacenter products
Tells users ‘action required’ – but maybe don’t make that action a Jira ticket, because it has this bug
CVE-2026-21589: Critical File Flaw Hits Atlassian Confluence
Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting Confluence Data Center and seven other self-managed products. The advisory, published on October 5, 2026, warns that every version of the affected software is exposed and urges administrators to act right away, either by upgrading or by putting temporary safeguards in place. Beyond Confluence Data Center, the flaw reaches Bitbucket Data Center, Jira…
A critical leak in Atlassian's Data Center products allows unauthorized file access without logging in. Updates are available.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
