Atlassian Warns of Critical Flaw Affecting Eight Self-Managed Products

What happened

Atlassian has disclosed CVE-2026-21589 (the public catalogue number for a specific software flaw), a critical arbitrary file access vulnerability affecting Confluence Data Center and seven other self-managed products. The advisory, published on October 5, 2026, warns that every version of the affected software is exposed and urges administrators to act right away, either by upgrading or by putting temporary safeguards in place. Atlassian is a software company based in Sydney, and its products and services include productivity software.

There is a catch for attackers: they must already know a file's exact name and location, since the weakness does not reveal or list directory contents. Beyond Confluence Data Center, the flaw reaches Bitbucket Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.

Atlassian is tracking the issue under BSERV-20604, CONFSERVER-104488, JSDSERVER-16809, JRASERVER-79546, BAM-26567, CWD-6610, CRUC-8741 and FE-7583. Which Atlassian Products CVE-2026-21589 Affects The bug lets an attacker with no login read specific files inside the web application's root directory.