Atlassian Data Center flaw exposes server files; exploited in the wild

What happened

Atlassian has disclosed a vulnerability, tracked as CVE-2026-21589, that lets a remote attacker with no login retrieve individual files stored inside the web application root directory of affected products. The weakness is classified as CWE-552, files or directories accessible to external parties.

There are limits. The attacker must already know the precise name and location of a file to fetch it, and the flaw cannot be used to browse or list folders. Atlassian notes, however, that some configurations may hold sensitive files in that location, which can make the impact severe.

The flaw is being actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-15. The CVE was published on 2026-10-05.

Who is affected

The flaw affects several Atlassian self-managed products. Fixed versions, with the first affected release in brackets: Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1 (from 4.6.0); Confluence Data Center 9.2.26 and 10.2.19 (from 5.10.0); Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4 (from 2.11.0); Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12 (from 7.1.0); Jira Service Management Data Center 5.12.40, 10.3.26 and 11.3.12 (from 3.1.0); Bamboo Data Center 10.2.24 and 12.1.12 (from 7.0.1); Crucible and Fisheye 4.9.15.

Bitbucket Server releases from 4.6.0 through 8.14.6 and Jira Service Desk Data Center from 3.1.0 through 4.13.27 are also listed as affected.

How serious is it

Atlassian rates the flaw 9.3 under CVSS version 4.0, which is critical. No authentication or user interaction is needed, and the attack works over the network.

Active exploitation and the KEV listing raise the urgency further. The EPSS score, an estimate of the likelihood of exploitation, stands at 0.99664. The need to know exact file paths narrows what an attacker can obtain, but exposed sensitive files could have a high impact. Ransomware use is not known.

What you should do

1. 1Update each affected Atlassian product to one of the fixed versions listed for its release line, such as Jira Software Data Center 9.12.40, 10.3.26 or 11.3.12.
2. 2Follow the Atlassian advisories for each product and apply the vendor mitigations where an update cannot be installed right away.
3. 3Assess which affected instances are reachable from the internet and prioritize those.
4. 4Federal agencies should complete the CISA required action by 2026-10-18, including its forensic triage guidance, or stop using the product if mitigations are unavailable.

Quick facts