Atlassian Patches Critical Vulnerability Affecting 8 Products
Atlassian has rolled out patches for a critical-severity vulnerability that impacts all versions of eight of its products.
The security defect, tracked as CVE-2026-21589 (CVSS score of 9.3), is described as an arbitrary file access issue.
It can be exploited without authentication to access specific files in the web application root directory.
“Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be sensitive files present that increase your risk,” Atlassian notes in its advisory.
All versions of Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center, and Jira Software Data Center are impacted, the company says.
Fixes were included in Bitbucket versions 9.4.26, 10.2.8, and 10.5.1; Bamboo versions 10.2.24 and 12.1.12; Confluence versions 9.2.26 and 10.2.19; Crowd versions 6.3.7,...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
