Atlassian discloses critical file-access flaw affecting eight products

The vulnerability, CVE-2026-21589, lets attackers without login credentials read specific files in the web application root directory of affected self-hosted Data Center products. It carries a severity score of 9.3 out of 10. Attackers must know the exact filename and path and cannot list directory contents, according to The Hacker News.

• Affected products include Jira, Confluence and Bitbucket.
• Atlassian disclosed the flaw on October 5, according to The Hacker News.

Covered by 3 publishers within 11 hours of the first report.

• The Hacker News: Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
• Latest 1:34 PM ET BleepingComputer: Atlassian warns of critical file-access flaw in Jira, Confluence

Reporting3

THN The Hacker News Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products · info@thehackernews.com (The Hacker News) 2:58 AM

CSN Cyber Security News Atlassian Patches Critical Vulnerabilities in Jira, Confluence, Bitbucket, and Five More Products · Abinaya 4:18 AM

BC BleepingComputer Atlassian warns of critical file-access flaw in Jira, Confluence · Bill Toulas 1:34 PM

Related

DCD AWS warns against 100 proposed data center bans in the US October 6

BL Seagate and Toshiba reportedly compete to buy TDK’s hard-drive head business October 5

QZ Nokia CEO says supply shortages halve potential data center building pace October 5

DCD Rapidus plans CORE initiative and adds four Malaysian chip design firms October 6

Topics Data centers