Security1 hOctober 18, 2026, 16:40

CVE-2026-21589: unauthenticated file read in eight Atlassian products

Atlassian patched CVE-2026-21589, rated 9.3 under CVSS v4.0, which lets an unauthenticated attacker read files under the web application root of Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Reading crowd.properties can expose the Crowd application password and enable admin account takeover.

DEV Community

Open source

CVE-2026-21589: unauthenticated file read in eight Atlassian products

Flaw affects eight self-hosted Data Center products
Read is limited to the app directory but needs no authentication
crowd.properties exposure can lead to admin account takeover
Fixed versions include Jira 11.3.12, Confluence 10.2.19, Bitbucket 10.5.1

#Atlassian#Jira#Confluence#Bitbucket

CVE-2026-21589: Critical Arbitrary File Access Flaw in Atlassian Data Center

Security

Atlassian CVE-2026-21589 Exploited Hours After Details Go Public

Security

CISA adds critical Atlassian flaw to Known Exploited Vulnerabilities catalog

Security

CVE-2026-21589: unauthenticated file read in eight Atlassian products

CVE-2026-21589: Critical Arbitrary File Access Flaw in Atlassian Data Center

Atlassian CVE-2026-21589 Exploited Hours After Details Go Public

CISA adds critical Atlassian flaw to Known Exploited Vulnerabilities catalog

ZoomEye Finds 185,584 Exposed Confluence and 91,979 Jira Instances