Atlassian has disclosed a critical vulnerability in eight of its self-hosted Data Center products that lets an attacker with no credentials read files from the server, The Hacker News reported Tuesday. The flaw, tracked as CVE-2026-21589 and rated 9.3 under CVSS version 4.0, affects widely deployed tools including Jira, Confluence and Bitbucket.

What Happened

Atlassian notified customers Monday with an email marked "Action required" that pointed to a new security bulletin, according to The Register. The bug is a path traversal flaw: an unauthenticated attacker can read specific files inside each product's web application root directory.

There are limits. The attacker must know the exact file name and path, and the flaw does not allow directory listing. Atlassian nonetheless warned that some configurations may hold sensitive files in reachable locations, which raises the risk.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

The affected products are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, along with Crucible and Fisheye. Fixed releases include:

  • Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1
  • Confluence Data Center 9.2.26 and 10.2.19
  • Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12
  • Jira Service Management Data Center 5.12.40, 10.3.26 and 11.3.12
  • Bamboo Data Center 10.2.24 and 12.1.12
  • Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4
  • Crucible and Fisheye 4.9.15

Atlassian's cloud products had already been patched, and cloud customers do not need to take action. The company said its investigation of the cloud products found no evidence of exploitation. The advisory does not say whether self-hosted instances have been attacked.

Why It Matters

Self-hosted Jira and Confluence servers are a long-standing target because they sit at the center of engineering and IT work and are often exposed to the internet. A 2021 path traversal bug in Jira, CVE-2021-26086, was added to the U.S. Cybersecurity and Infrastructure Security Agency's catalog of known exploited vulnerabilities in November 2024, and Confluence flaws have repeatedly been exploited within days of disclosure.

Atlassian's own guidance reflects the severity. It advised that internet-facing instances, including those behind user authentication, be cut off from external network access until they are upgraded or temporary blocking rules are in place.

The Register noted that the episode appears to vindicate Atlassian's 2020 decision to stop selling its lower-end Server products and push customers to the cloud, where this flaw was fixed before disclosure. The Data Center editions remain the main option for organizations that must keep the software on their own infrastructure.

Mitigations and Detection

For customers who cannot upgrade right away, Atlassian described three ways to block malicious requests: a web application firewall or reverse proxy rule rejecting URLs that contain ".." next to a slash or a double colon, including URL-encoded forms; a Tomcat RewriteValve rule for Confluence, Jira, Bamboo and Crowd; and urlrewrite.xml rules for Bitbucket, applied to every node and mirror. The latter two require a restart.

Atlassian said those measures are limited and not a replacement for patching. To check for past attempts, it recommends searching access logs for request lines that, after up to two rounds of URL decoding, contain the same ".." patterns.

What to Watch

Watch for public proof-of-concept code, which typically follows quickly once fixed and vulnerable versions can be compared, and for reports of scanning or exploitation against internet-facing Data Center servers. A listing in CISA's known exploited vulnerabilities catalog would set patch deadlines for U.S. federal agencies.