Atlassian warns of critical file-access flaw in Jira, Confluence

Key Points:

• Atlassian has disclosed a critical vulnerability (CVE-2026-21589) affecting multiple self-hosted Data Center products, including Confluence, Jira, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye, allowing unauthenticated attackers to access specific files if they know the exact file name and path.
• The vulnerability does not permit attackers to list or enumerate directory contents, but it poses a significant risk if exploited; affected product versions must be updated to the fixed releases specified by Atlassian.
• Atlassian urges system administrators to apply security updates immediately and recommends temporary mitigations such as restricting external network access, deploying web application firewalls, or implementing specific rewrite rules if patching is delayed.
• Cloud customers are unaffected as Atlassian has automatically applied patches to cloud instances, but self-hosted users should review access logs for suspicious traversal patterns and coordinate with their security teams to assess potential compromises.
• Detailed instructions for temporary mitigations are provided by Atlassian, and all cluster nodes, including mirrors, must be covered to ensure full protection against potential exploitation.