Atlassian says organizations running its self-hosted Data Center products need to patch quickly because an unauthenticated attacker may be able to access files on affected servers. The issue, CVE-2026-21589, is a 9.3-severity arbitrary file access flaw affecting Data Center versions of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. Atlassian says exploitation requires knowing the exact file path and name, and advises customers who cannot patch immediately to restrict public internet access.
Why it matters: This can expose sensitive files from business-critical collaboration and development systems without a login, so internet-exposed deployments are at particular risk. Organizations using Atlassian Data Center should update now or remove external access until they can apply fixes and review Atlassian’s mitigation guidance.
info@thehackernews.com (The Hacker News)
2026.10.07
95% relevant
This is the same underlying event: Atlassian's critical Data Center flaw CVE-2026-21589. The new information is that exploitation attempts were observed within about two hours of public technical details becoming available, underscoring immediate attacker interest and patch urgency.
Ionut Arghire
2026.10.07
95% relevant
This source directly covers the same Atlassian event and adds patch-version details across the eight affected Data Center products, along with Atlassian's guidance to restrict internet exposure and WatchTowr's warning that Crowd configurations may expose plaintext authentication details from a predictable path.
Bill Toulas
2026.10.06
99% relevant
This article reports the same underlying event: Atlassian's disclosure of CVE-2026-21589 in self-hosted Data Center products. It adds product-specific patch versions, mitigation guidance including WAF, Tomcat RewriteValve, and Bitbucket URL rewrite rules, and notes Atlassian says it has no current evidence of active exploitation.
info@thehackernews.com (The Hacker News)
2026.10.06
98% relevant
This appears to be the same underlying event: Atlassian's disclosure of CVE-2026-21589, a critical unauthenticated file-access issue affecting eight Data Center products. The article mainly reframes the impact as reading known files across the affected product set.
2026.10.06
100% relevant
This article appears to be the first tracked item here for Atlassian's CVE-2026-21589 advisory covering multiple Data Center products and the required patching guidance.
← Back to all stories