Atlassian disclosed a critical security vulnerability affecting eight self-hosted Data Center products that allows attackers without login credentials to access specific files from each product’s web application directory. The flaw, identified as CVE-2026-21589 and rated 9.3 out of 10 in severity, requires attackers to know the exact file name and path beforehand. Atlassian released patched versions for all affected products on October 5, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Cloud-hosted versions have already been patched and require no customer action.
For customers unable to upgrade immediately, Atlassian recommends taking affected instances offline or restricting external network access. The company provides three temporary blocking rules that filter requests containing path traversal patterns, though these measures are not replacements for applying security patches. Customers are advised to search their access logs for evidence of potential exploitation. The vulnerability represents a path traversal flaw similar to a previous Atlassian vulnerability exploited by attackers, highlighting ongoing security challenges with the company’s products.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
