Atlassian warns of 9.3 flaw affecting eight data center products

Atlassian is warning customers of a critical vulnerability tracked as CVE-2026-21589 that can be exploited for arbitrary file access in multiple self-hosted data center products. The security issue allows an unauthenticated attacker to access specific files within an affected application web web root directory without requiring login access or user interaction.bleepingcomputer.com+1

CVE-2026-21589 rated 9.3 critical severity is an arbitrary file access vulnerability that could allow an attacker with no login access to read files in web app root directories that they should not otherwise see. The impacted products require immediate attention as stated by the company in a security advisory issued to customers managing self-hosted instances of these enterprise software tools.

Products requiring immediate attention

The arbitrary file access vulnerability is present in all versions of Bamboo data center Bitbucket data center Confluence data center Crowd data center Crucible Fisheye Jira service management data center and Jira software data center. Atlassian said it has not yet found evidence of exploitation in its cloud offerings which are already patched according to the vendor but urged administrators to review access logs for the traversal patterns described.

Exploitation requires prior knowledge of the target file exact name and path as the vulnerability does not allow attackers to enumerate or list directory contents within the application. For those who cannot patch right away the company advised removing affected instances from the internet and restricting internet accessible instances from external network access including instances that require authentication.

Mitigations and next steps

Atlassian outlined three temporary mitigations to block attackers including applying a rule on a web application firewall or proxy layer or using Tomcat rewrite valve rules on each node in their data center cluster. But Atlassian called the mitigations limited and not a replacement for patching your instance adding that it cannot confirm whether a particular enterprise instances have been affected by this vulnerability.

The vendor cannot tell you whether you were visited according to security researchers only your logs can show evidence of compromise so you must engage your local security team to check all affected instances. Patch your systems today or isolate exposed instances completely to prevent unauthenticated attackers from accessing files that could enable a much broader attack across your enterprise systems and networks.