Security2 hOctober 12, 2026, 08:46

CVE-2026-21589: Critical Arbitrary File Access Flaw in Atlassian Data Center

Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read vulnerability affecting all self-hosted Data Center products, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye. A working PoC appeared a day later, and honeypots logged exploitation attempts within hours.

DEV Community

Open source

CVE-2026-21589: Critical Arbitrary File Access Flaw in Atlassian Data Center

CVSS 9.3: unauthenticated remote file read across 8 Data Center products
Fixes: Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, Jira 9.12.40/10.3.26/11.3.12
190 exploitation attempts from 32 IPs in 10 countries within a day of the PoC
Crowd config exposure can let attackers create admin users and own identity layer

#Atlassian#Bitbucket#Confluence#Jira

Atlassian CVE-2026-21589 Exploited Hours After Details Go Public

Security

MCP Atlassian Falls Back to Operator Credentials Without Verified Identity

Software

Atlassian opens Jira Automation Rules management API

Security

CVE-2026-21589: Critical Arbitrary File Access Flaw in Atlassian Data Center

Atlassian CVE-2026-21589 Exploited Hours After Details Go Public

MCP Atlassian Falls Back to Operator Credentials Without Verified Identity

Atlassian opens Jira Automation Rules management API

ZoomEye: 1.8M Confluence matches depend on which fingerprint you use