Atlassian has told customers to patch a 9.3-rated flaw in its self-hosted products. CVE-2026-21589 lets an unauthenticated attacker read specific files from a web application's root directory. The Register reported the notice on October 6, 2026.
Atlassian emailed customers on Monday, October 5. The Register reports the Data Center versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye are affected. Atlassian says it has already fixed its own cloud products, so cloud customers need to do nothing.
The bug is arbitrary file access. No login is required. The attacker has to know the exact filename and path, and cannot list directory contents. That limits blind exploitation. Atlassian still warns that some configurations hold sensitive files in the web root, which raises the risk. The Register's report does not say whether the flaw is being exploited. Other trackers describe the bug as an authentication bypass, which does not match Atlassian's wording. We have seen no confirmation of in-the-wild exploitation.
Why it matters: Jira, Confluence and Bitbucket sit at the centre of engineering and ticketing workflows. They hold source code, tickets and credentials pasted into both. Instances exposed to the internet are the first to be probed once a file-access bug is public.
What to do. Upgrade to the fixed Data Center versions listed in Atlassian's security bulletin. If you cannot patch yet, take the instance off the public internet. Atlassian says internet-exposed instances, including those requiring user authentication, should be restricted from external network access until patched. Check the web root for sensitive files such as configuration backups or exported data. Review web server logs for unauthenticated requests to unusual static paths.
