Atlassian warns of critical file access flaw in its datacenter products
Atlassian urges patches for CVE-2026-21589, an unauthenticated file-read flaw in eight Data Center products.
Atlassian emailed customers an “Action required” notice for CVE-2026-21589, a CVSS 9.3 arbitrary file-access flaw in Data Center editions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows an exact filename and path can read specific files under the web application root; directory listing is not possible, but some configurations may hold sensitive files. Patched versions are available, and Atlassian Cloud is already fixed. Customers who cannot upgrade immediately are told to remove internet-exposed instances from external access.
- CVE-2026-21589 is rated 9.3 and allows unauthenticated file reads.
- Eight Data Center products, including Jira and Confluence, are affected.
- Attackers need the exact path and cannot list directories.
- Atlassian Cloud is already fixed; exposed instances should be isolated.
Vulnerabilities mentionedAll →
- CVE-2026-215899.32%This: Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access…published PoC ×7
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-21589 | This: Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access… |
Full article418 words · extracted from theregister.com · click to collapse
security
Tells users ‘action required’ – but maybe don’t make that action a Jira ticket, because it has this bug
Atlassian has told its users to patch its datacenter products, pronto, to prevent attackers accessing their files.
The Australian collaborationware company on Monday sent users an email that opens with the words “Action required” and points to a security bulletin that explains CVE-2026-21589. The 9.3-rated arbitrary file access vulnerability is present in the datacenter versions of its Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye products.
Atlassian says the vulnerability “allows an unauthenticated attacker to access specific files within the web application root directory in affected versions.”
REG AD
That’s scary because Atlassian warns “In some configurations, there may be sensitive files present that increase your risk.”
REG AD
There’s also some good news in that attackers must know the exact filename and path to exploit the vulnerability, and the mess doesn’t allow anyone to see the contents of a directory. Another piece of good news is that Atlassian has updated its products – so users only need to find a change window in which to upgrade to a safe version of their software.
Atlassian advised those who can’t patch ASAP to remove their instances from the internet, if possible. “Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can take action,” the company warned. Its advisory also includes mitigations and advice on how to determine if your instances need the fix.
Users who made the move from datacenter products to the Atlassian cloud have nothing to do, as Atlassian fixed the flaws in its own SaaS. That state of affairs rather vindicates Atlassian’s 2020 decision to stop developing its low-end server products and require users to shift into its cloud, and last year’s sequel in which it decided to discontinue its datacenter software, too.
Atlassian admitted it hasn’t made that migration easy, because it somehow released a lift and shift tool that was worse than an earlier version.
In March 2026, Atlassian axed ten percent of staff. The company’s share price was on a year-long slide at the time, as pundits suggested it might fall victim to the SaaSPocalypse, a theory that AI would replace business software. The price of Atlassian scrip has tripled since then, suggesting investors are more confident the company’s plan to use AI to power workflows represents a moat LLMs cannot cross. ®
Akamai Blog