Atlassian published a security advisory on October 5, 2026 for CVE-2026-21589, an arbitrary file access vulnerability that affects eight of its self-hosted Data Center products.
What Atlassian's advisory says:
- The flaw lets an unauthenticated attacker access specific files within the web application root directory.
- Exploitation requires prior knowledge of the target file. Atlassian describes the access as reading known files, not listing a directory.
- Atlassian rates it Critical, CVSS 4.0 score 9.3, and notes the score is its own internal assessment that customers should evaluate for their environment.
- All versions of these products before the fixed versions are affected: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.
Fixed versions listed by Atlassian:
- Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center: 9.2.26, 10.2.19
- Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
- Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
- Bamboo Data Center: 10.2.24, 12.1.12
- Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
- Crucible: 4.9.15
- Fisheye: 4.9.15
What Atlassian tells customers:
- Patch to a fixed version or the latest version, and Atlassian recommends a fixed long-term support (LTS) release or later.
- If you cannot patch right away, remove the instance from the internet if possible. Instances reachable from the public internet, including ones that require a login, should be restricted from outside network access until patched, or protected by a web application firewall rule that Atlassian describes in the advisory.
- Atlassian's cloud products are not part of the affected list in the advisory.
What The Hacker News adds:
- It reports Atlassian's cloud products were already patched, so cloud customers need no action.
- It points out that the CVE record and the Jira tickets show some version numbers that differ from the advisory, for example for Crowd and Bamboo, and that the CVE record also lists Server editions that the advisory does not mention. If you run those, check Atlassian's advisory and tickets directly before relying on a version number.
What we could not confirm: Atlassian's advisory does not say the flaw is being exploited, and we did not find a source that says so. We did not independently test the flaw.
Sources: Atlassian security advisory for CVE-2026-21589, and The Hacker News report on the flaw.