Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian has disclosed CVE-2026-21589, a critical vulnerability affecting several self-hosted Data Center products, including Jira, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw lets an unauthenticated attacker retrieve specific files from an application's web root, though exploitation requires already knowing the exact file name and path, meaning directory listing is not possible. Fixed versions are now available for each product, and cloud deployments have already been patched automatically by Atlassian, while self-hosted administrators are urged to update every cluster node immediately. Atlassian says it has no current evidence of active exploitation but recommends restricting network exposure, applying WAF or proxy rules, and reviewing logs for traversal attempts as temporary safeguards until patching is complete.