Atlassian Patches Critical Vulnerability Affecting 8 Products

Atlassian has issued fixes for a critical flaw, CVE-2026-21589 (CVSS 9.3), that lets unauthenticated attackers read specific files within the web root of eight products, provided they already know the exact file name and path. All versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are affected, with fixed releases now available for each (for example Bitbucket 10.5.1, Confluence 10.2.19, and Jira 11.3.12). Atlassian and security firm WatchTowr say there's no sign of active exploitation yet, but warn that similar bugs have previously been weaponized by ransomware crews and APTs, and that Crowd deployments using SSO are especially risky since plaintext authentication data sits in a predictable location that could let attackers forge admin accounts. Administrators are urged to patch self-hosted instances immediately or, if that's not possible, cut off public internet access and apply the vendor's WAF mitigations in the meantime.