CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Rapid7 reports that on October 5, 2026, Atlassian published a security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability[2]. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye[2]. Rapid7 says Atlassian assigned the vulnerability a CVSSv4 score of 9.3.[2]Atlassian's advisory says the flaw "allows an unauthenticated attacker to access specific files within the web application root directory"[3]. The company adds that exploitation "requires prior knowledge of the target file's exact name and path"[3].According to Rapid7, Atlassian Cloud products have already been patched, and Cloud customers do not need to do anything.[2]Help Net Security reports that watchTowr found a quirk in the routing code: functions that convert double colons (::) into forward slashes (/)[4]. Rapid7 says that in watchTowr's test of a Crowd deployment, reading WEB-INF/classes/crowd.properties exposed application credentials.[2]Help Net Security reports that attackers were seen trying to exploit the flaw one day after Atlassian released patches[4]. In a statement to The Hacker News, watchTowr's Jake Knott said "No post-compromise activity or attackers attempting to utilize the credentials obtained by exploiting the vulnerability have been observed so far."[1]According to Help Net Security, Atlassian urged customers to upgrade to a fixed version as soon as possible.[4] Rapid7 reports that public proof-of-concept scripts exist, and it recommends patching on an emergency basis, outside normal patch cycles[2].