Atlassian has released urgent fixes for CVE-2026-21589, a critical arbitrary file access flaw affecting eight Data Center products, including Bitbucket, Confluence, Jira, and Crowd. The issue can be exploited without authentication to access specific files, and organizations are urged to patch immediately or restrict public internet access until remediation is complete. #Atlassian #CVE-2026-21589 #Bitbucket #Confluence #Jira #Crowd
Keypoints
- Atlassian patched CVE-2026-21589, a critical arbitrary file access vulnerability.
- The flaw affects all versions of eight Atlassian products, including Bitbucket, Bamboo, and Confluence.
- Attackers can exploit the issue without authentication if they know the exact file path and name.
- Atlassian recommends immediate patching or disconnecting self-hosted instances from the internet.
- WatchTowr warned that Crowd SSO deployments may expose plaintext authentication details if endpoints are reachable.
Read More: https://www.securityweek.com/atlassian-patches-critical-vulnerability-affecting-8-products/