Source: The Hacker News
Atlassian disclosed CVE-2026-21589 on October 5, 2026, and the details deserve attention from every team that runs Atlassian software on its own infrastructure. The flaw is rated 9.3 out of 10 and affects eight Data Center products, and it allows an attacker with no credentials at all to read specific files from the web application root directory of an affected instance.
What the flaw exposes
The attacker must already know a file’s exact name and path and cannot browse the directory listing, which limits the blast radius in some configurations. But Atlassian itself warns that the web application root directory can hold sensitive files depending on how the deployment is set up. For products that sit at the heart of software delivery, such as Bitbucket and Bamboo, that is not a comfortable combination. A readable configuration or properties file in that directory could hand over credentials or secrets that unlock far more than one product.
Who needs to act
The affected products are the self-hosted Data Center editions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye, in all versions before the fixed releases. Atlassian has published fixed versions for each product, including 10.5.1 for Bitbucket, 10.2.19 for Confluence, 11.3.12 for Jira Software, and 12.1.12 for Bamboo, and recommends upgrading to a fixed LTS version or later. Cloud customers do not need to do anything because hosted instances were patched before disclosure. Atlassian also noted that its older Server line is marked as affected with no fixed versions, so any organization still running EOL Server editions is out of options except migration or isolation.
The practical guidance
For teams that cannot upgrade immediately, Atlassian’s advice is blunt: take the instance offline if possible, and if it must stay up, restrict it from outside network access until it is upgraded or a blocking rule is in place. That guidance should trigger a wider question for European engineering organizations. How many of your internal Atlassian instances are reachable from the public internet, and do you have an inventory that would even let you answer that question this week?
If you are not sure, contact Excello Digital at https://excello.digital/contact/. We help teams inventory their self-hosted tooling, prioritize patching against real exposure, and put network isolation in place so a CVSS 9.3 disclosure becomes a scheduled upgrade instead of a weekend emergency.