Signal is active with 30 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
‼️ A critical Atlassian vulnerability rated CVSS 9.3 affects 8 Data Center products. CVE-2026-21589 can let unauthenticated attackers read specific files if they know the exact file path. Internet-facing instances should be upgraded or restricted. Details - https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html
The watchTowr team is rapidly reacting to CVE-2026-21589, a vulnerability letting unauthenticated attackers read specific server files if they know the exact path, affecting Atlassian products, including Jira, Confluence, and more. watchTowr clients know their exposure, Active Defense mitigations have been made available.
🚨 ATLASSIAN PATCHES CRITICAL CVE-2026-21589 (CVSS 9.3) ACROSS DATA CENTER PRODUCTS Atlassian has disclosed CVE-2026-21589, a critical unauthenticated arbitrary file access (path traversal) flaw in its self-managed products, published Oct 5, 2026. Per Atlassian: • CVSS 4.0 score 9.3 (Critical), no authentication needed • A remote attacker can read specific files inside the web application root • Affects Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye (Data Center/Server) • Fixed: Jira 9.12.40 / 10.3.26 / 11.3.12; JSM 5.12.40 / 10.3.26 / 11.3.12; Confluence 9.2.26 / 10.2.19; Bitbucket 9.4.26 / 10.2.8 / 10.5.1; Bamboo 10.2.24 / 12.1.12; Crowd 6.3.7 / 7.0.3 / 7.1.1 / 7.2.4; Crucible & Fisheye 4.9.15 • Atlassian Cloud is already patched. WAF / URL-rewrite mitigations are offered if you cannot upgrade yet ⚠️ Analyst Note: Exploitation requires the exact name and path of the target file; the bug does not allow directory listing. As of Oct 5, it is not in CISA KEV and no public exploit has been reported. Some configurations may still expose sensitive files, so patch internet-facing instances first. End-of-life versions may also be affected. Source (Atlassian): https://jira.atlassian.com/browse/CONFSERVER-104488 #DDW #DarkWeb #Atlassian #Jira #Confluence #CVE #CyberSecurity
AtlassianのJira・Confluence・Bitbucket含むData Center版8製品に、認証なしでファイルを読み出せる脆弱性CVE-2026-21589が見つかった。 https://joho-todai.com/atlassian-jira-confluence-cve-2026-21589-vulnerability/ CVSS 9.3。 修正版より前の全バージョンが対象になる。 ファイルの正確なパスが必要でディレクトリ列挙はできないとされているが、Atlassian製品の標準的なディレクトリ構造は広く知られている。 設定ファイルや認証情報が露出する可能性は現実的に残る。 Cloud版は修正済みで対応不要。 Data Center版は修正版が公開されており即時更新が必要。 更新できない場合はまずインターネットから切り離す。
Atlassian Data Center vulnerability CVE-2026-21589 (CVSS 9.3) allows arbitrary file access in Jira, Confluence and Bitbucket. Patch now. #Atlassian #Jira #Confluence #Bitbucket #CVE202621589 #PathTraversal #DataCenter #Vulnerability https://securityonline.info/atlassian-data-center-vulnerability-cve-2026-21589/
Atlassian製品群に重大(Critical)な脆弱性。CVE-2026-21589はCVSSv4スコア9.3のWebアプリケーションルート内任意ファイルアクセスで、Jira、Confluence、Bitbucket、Bamboo、Crowd、Fisheyeの全バージョンに影響。悪用にあたっては対象ファイル名を特定する必要。修正有。 https://securityonline.info/atlassian-data-center-vulnerability-cve-2026-21589/
Atlassian disclosed CVE-2026-21589, a critical path traversal flaw in 8 Data Center products that can let unauthenticated attackers read known files from the web root. #Atlassian #CVE202621589 #Jira https://www.hendryadrian.com/critical-atlassian-flaw-lets-unauthenticated-attackers-read-known-files-across-8-products/
Atlassian patched critical CVE-2026-21589, which allows unauthenticated file access. Users should patch immediately or restrict internet access. https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/5301284 #Atlassian #vulnerability #CVE #critical #CyberSecurity #CybersecurityNews #threatresq #ThreatResQ
Need to understand your exposure? Reach out here: https://watchtowr.com/emerging-threats/cve-2026-21589-atlassian-arbitrary-file-access-vulnerability/
ثغرة حرجة في منتجات Atlassian ثغرة أمنية بتقييم CVSS 9.3 تؤثر على 8 منتجات Data Center. CVE-2026-21589 تتيح للمهاجمين غير المُصادَقين قراءة ملفات محددة إذا عرفوا المسار الدقيق. النسخ المتصلة بالإنترنت تحتاج ترقية أو تقييد فوري. https://t.co/YgO5gpgzcI
【セキュリティ ニュース】複数のAtlassian製品が影響を受ける「クリティカル」脆弱性（1ページ目 / 全1ページ）：Security NEXT https://www.security-next.com/191078 #ss954 同社は現地時間2026年10月5日、セキュリティアドバイザリを公開し、ファイルアクセスに関する脆弱性「CVE-2026-21589」を明らかにした
🚨 #Atlassian just disclosed a 9.3 critical: CVE-2026-21589 lets attackers with no login read known files in the web root of 8 self-hosted Data Center products, including #Jira, Confluence and Bitbucket. Cloud is already patched and no exploitation has been seen yet. Internet-facing on-prem? Atlassian says lock it down until you upgrade. How fast does your team ship patches like this?
🚨 #Atlassian just disclosed a 9.3 critical: CVE-2026-21589 lets attackers with no login read known files in the web root of 8 self-hosted Data Center products, including #Jira, Confluence and Bitbucket. Cloud is already patched and no exploitation has been seen yet. Internet-facing on-prem? Atlassian says lock it down until you upgrade. How fast does your team ship patches like this?
Is your attack surface exposed to this? Find out with watchTowr: https://watchtowr.com/emerging-threats/cve-2026-21589-atlassian-arbitrary-file-access-vulnerability/
In brief: Atlassian discloses critical file access flaw in Jira, Confluence and Bitbucket Atlassian has warned of a critical arbitrary file access vulnerability, CVE-2026-21589, affecting eight products including Jira, Confluence and Bitbucket. The flaw lets unauthenticated attackers access specific files in the web root directory. Atlassian is urging customers to patch immediately.
Eight self-hosted Atlassian products can leak a known file with no login. CVE-2026-21589 is scored 9.3. Cloud is patched. If Jira or Confluence faces the internet, upgrade or take it offline. #CVE #InfoSec Link: https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html
Jira, Confluence ou Bitbucket chez vous ? À patcher cette semaine. Faille critique sur 8 produits Atlassian Data Center : on y lit des fichiers sans compte, si on connaît le chemin. Le cloud est déjà corrigé. En attendant, sortez l'instance d'internet. https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
CVE-2026-21589, CVSS 9.3, afecta a 8 productos de Atlassian Data Center: un atacante sin autenticar lee archivos si conoce la ruta exacta. https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html
A critical zero-auth path traversal (CVE-2026-21589) in Atlassian’s Data Center line lets attackers read known files in the web root across Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible & Fisheye. Self-hosted users must upgrade to safe versions or implement mitigation rules like WAF filters, RewriteValve or urlrewrite.xml immediately before exposure expands. #Security #Atlassian #CVE2026 #PathTraversal #ZeroAuth #Cybersecurity https://thedailytechfeed.com/critical-atlassian-vulnerability-exposes-files-in-8-self-hosted-products/
Atlassian just patched a massive vulnerability—CVE-2026-21589—that exposed files in Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible & Fisheye. Any org running unpatched Data Center versions could have been letting unauthenticated attackers access known files in web roots. Cloud editions are already fixed. If you can’t patch immediately, use Atlassian’s proxy or WAF rules, and update to one of the safe patched versions now. #SecurityNews #Atlassian #CVE2026-21589 #Vulnerability #InfoSec #Cybersecurity https://thedailytechfeed.com/atlassian-rushes-out-fixes-for-critical-file-access-exploit/