Atlassian discloses critical file access flaw in Data Center products

Atlassian has disclosed a critical arbitrary file access vulnerability, identified as CVE-2026-21589, affecting eight of its Data Center products. The flaw, which carries a CVSS score of 9.3, allows unauthenticated attackers to read specific files within the web application’s root directory. Affected products include Confluence Data Center, Bitbucket Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.

Exploitation requires the attacker to know the exact filename and path of the target file, as the vulnerability does not allow for directory listing or enumeration. However, security researchers note that configuration files and logs often have predictable names. Reports indicate that exploitation attempts were detected within two hours of the technical details being made public, with telemetry identifying activity originating from IP addresses in the United States and Japan.

Atlassian has released patches for all affected self-managed products and urges administrators to upgrade to fixed versions immediately. Cloud users are not affected, as Atlassian has already patched its SaaS offerings. For those unable to patch immediately, Atlassian recommends restricting external network access to the instances or implementing Web Application Firewall (WAF) rules and URL rewrite mitigations.