Atlassian Urges Data Center Product Users to Patch Critical File Access Vulnerability
SC Media, Tuesday, October 6th, 2026
Atlassian urges Data Center customers to patch CVE-2026-21589, a critical flaw letting unauthenticated attackers read web root files.
Atlassian is urging users of its Data Center products to patch immediately after disclosing CVE-2026-21589, a flaw rated 9.3 in severity.
It affects Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye, letting unauthenticated attackers access specific files in the web application root directory if they know the exact file names and paths.
Atlassian recommends cutting internet access to exposed instances until they are patched, while cloud customers are already protected.