Atlassian Warns of Critical Flaw Affecting Eight Self-Managed Products

Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) arbitrary file access vulnerability affecting Confluence Data Center and several other self-managed Atlassian products (Bitbucket, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, Fisheye). The advisory lists fixed versions to upgrade to, recommends immediate upgrades or stopgap mitigations (WAF regex, Tomcat RewriteValve, Bitbucket urlrewrite rule), instructs how to search logs for suspicious attempts, and states cloud customers are not affected and no exploitation has been observed.