Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)

Atlassian has disclosed a critical flaw, tracked as CVE-2026-21589 with a CVSS score of 9.3, that lets an attacker read files from the web root of several Data Center products without any authentication. The issue affects every version of Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye, though exploitation requires the attacker to already know the exact name and path of the targeted file, since directory listing isn't possible. Cloud versions of these products have already been fixed and Atlassian says it found no sign of in-the-wild abuse there, but on-premise Data Center customers are urged to upgrade immediately to the patched releases—such as Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, Jira 10.3.26/11.3.12, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, and Crucible/Fisheye 4.9.15—or at minimum isolate internet-facing instances and apply the temporary mitigations Atlassian has published while reviewing logs for signs of compromise.