Atlassian Patches Critical File-Access Flaw Affecting Eight Products
Summary
Atlassian patched an unauthenticated file-access vulnerability affecting all versions of eight products. The flaw requires knowing a target file’s exact path; there is no evidence of in-the-wild exploitation.
Key points
- CVE-2026-21589 has a CVSS score of 9.3 and allows unauthenticated access to specific files in the web application root.
- Exploitation requires prior knowledge of the target file’s exact name and path; the flaw does not allow directory listing.
- Affected products include Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center.
- Atlassian released fixed versions across all eight products; organizations should consult the advisory for the applicable version.
- Atlassian and WatchTowr reported no evidence that the vulnerability is being exploited in the wild.
- Patch self-hosted deployments promptly; if patching is delayed, restrict internet access or apply the vendor’s temporary mitigations.
- WatchTowr warned that Crowd SSO credentials stored in a predictable plaintext path may be at risk if affected Crowd endpoints are remotely accessible.
Article Details
- Vulnerability Types
- Arbitrary file access
- Severity
- Critical (CVSS 9.3)
- Affected Versions
- All versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict instances accessible to the public internet from external network access until patches can be installed.
- Disconnect self-hosted instances from the internet until fixes can be installed.
- Deploy WAF rules to block exploitation attempts, following vendor guidance.
CVE
People
Vendors
Products
Bamboo Data CenterAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.Bitbucket Data CenterAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.Confluence Data CenterAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.Crowd Data CenterAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.CrucibleAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.FisheyeAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.Jira Service Management Data CenterAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.Jira Software Data CenterAll versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.