Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
Summary: Atlassian disclosed CVE-2026-21589 on October 5, a path traversal flaw rated 9.3 under CVSS 4.0 that lets an unauthenticated attacker read specific files in the web application root directory of 8 self-hosted Data Center products, provided the attacker already knows the exact file name and path. Atlassian says its cloud products are patched, reports no evidence of exploitation, and advises customers who cannot upgrade immediately to take instances offline or restrict public internet access, while its CVE record marks every version of Bamboo Server, Bitbucket Server, Confluence Server, and Crowd Server as affected with no fixed versions listed.
Key Takeaway: The same class of flaw, CVE-2021-26086 in Jira Server and Data Center, was added to CISA's known exploited vulnerabilities catalog on November 12, 2024, so this is a pattern attackers have already worked. Atlassian states it cannot confirm whether your instances have been affected and directs security teams to search access logs themselves, which puts the detection burden on you.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-26086CVE-2026-21589
- Related
- CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Known Exploited Vulnerabilities · Oct 15, 2026CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 12, 2024