2026-015: Critical Vulnerability in Multiple Atlassian Products
ID: 0e18e518-aea6-5549-b620-e29ca6382902
STIX ID: report--0e18e518-aea6-5549-b620-e29ca6382902
Feed Name: CERT-EU Security Advisories
Threat Score
On 5 October 2026 Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) arbitrary file access vulnerability affecting Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye Data Center products. CERT-EU and Atlassian recommend immediate patching to fixed versions (prioritizing internet-facing instances), checking access logs for signs of exploitation, and applying provided WAF/rewrite mitigations if patching cannot be completed immediately.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.