2026-015: Critical Vulnerability in Multiple Atlassian Products

Critical Vulnerability in Multiple Atlassian Products

On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye [1].

CERT-EU strongly recommends upgrading all affected installations to a fixed version as soon as possible, starting with instances accessible from the internet. CERT-EU also recommends checking access logs for signs of exploitation.

The vulnerability CVE-2026-21589, with a CVSS score of 9.3, is an arbitrary file access vulnerability that allows an unauthenticated attacker to access specific files within the web application root directory [1].

To exploit the vulnerability, an attacker needs to know the target file's exact name and path in advance. The vulnerability does not allow attackers to enumerate or list directory contents. Atlassian notes that some configurations may contain sensitive files that increase the risk [1].

All versions earlier than the fixed versions listed below are affected [1]:

Atlassian states that affected Atlassian Cloud products have been patched and that its investigation has not found evidence of exploitation [1].

Additional information is available in the vendor's advisory [1].

CERT-EU strongly recommends upgrading all affected installations to a fixed version or the latest version as soon as possible, starting with internet-facing instances. Atlassian recommends patching to the fixed LTS version or later [1]. CERT-EU also recommends checking access logs for signs of exploitation.

If patching is not immediately possible, remove the instance from the internet until it can be patched or mitigated (this includes instances accessible from the public internet that require user authentication) [1], or: