arbitrary file access

Atlassian File Access Vulnerability in Data Center

By Editorial Team | October 8, 2026

Atlassian Data Center file access vulnerability CVE-2026-21589 (CVSS 9.3) hits eight products with no login. No exploitation reported yet. Patch now.

The Atlassian file access vulnerability CVE-2026-21589 (CVSS 9.3) lets an unauthenticated attacker read files from the web root of eight self-hosted products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Every version is affected until it is upgraded. No exploitation has been reported so far, and the patched releases are out.…