Confluence Data Center

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file-access vulnerability affecting self-hosted Data Center versions of Confluence, Jira and Bitbucket. The flaw could let attackers read sensitive files on affected servers. Atlassian is urging administrators to patch immediately. Security commentators are sharing the advisory and warning self-hosted deployments to act quickly.

Atlassian has a critical vulnerability, tracked as EUVD-2026-92807, affecting a range of its enterprise products including Bitbucket Data Center, Crowd Server, Crucible Data Center, Confluence Data Center and Jira Service Management. The flaw carries a CVSS v3.1 severity score of 9.3 out of 10, putting it in the critical range. The advisory was updated on 5 October 2026, and security teams are being urged to check whether their deployments of the affected Atlassian products are exposed.

A critical vulnerability, CVE-2026-21589 with a CVSS score of 9.3, allows unauthenticated file reads in eight self-hosted Atlassian Data Center products, including Bitbucket, Confluence and Jira. Attackers must know a file's exact name or path, as there is no directory listing. Fixed versions have been released, and security experts urge administrators to restrict public access until they upgrade.