Warning: Critical, unauthenticated path traversal in Atlassian (Bitbucket, Jira, Confluence, Bamboo, Crowd) Data Centre, Cricible, Fisheye, Patch Immediately!
ID: 2bc7d1e0-0db0-53e2-b9c6-9737a9cabaa7
STIX ID: report--2bc7d1e0-0db0-53e2-b9c6-9737a9cabaa7
Atlassian and the Centre for Cybersecurity Belgium warn of CVE-2026-21589, a critical (CVSS 9.3) unauthenticated path traversal in multiple Atlassian Data Center products (Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, Fisheye) that allows remote attackers to retrieve files from the application web root if exact paths are known; organizations are advised to apply vendor updates immediately and increase monitoring, noting that no public proof-of-concept or confirmed exploitation was available at the time of the advisory.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.