Atlassian Patches Critical Vulnerability Affecting 8 Products

What it is

CVE-2026-21589 (CVSS 9.3), an unauthenticated arbitrary file access vulnerability affecting all versions of Atlassian Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center.

How it works

Atlassian describes the flaw as allowing access to specific files in the web application root directory without authentication. Exploitation requires the attacker to already know the exact target file's name and path — the vulnerability does not permit directory listing or enumeration. Risk increases when sensitive files happen to exist at predictable locations in a given configuration.

The Crowd-specific risk WatchTowr flags fits this exact model: Crowd stores SSO authentication details in plaintext at a known, predictable path, so an attacker who knows that path can retrieve credentials without needing enumeration, then mint their own admin accounts.

Preconditions / Affected

• All versions of the eight listed products are affected (Data Center editions for most; Crucible and Fisheye entirely).
• Instance must be reachable — Atlassian specifically warns that internet-accessible instances are at risk even when user authentication is enabled.
• Crowd deployments used for SSO are the highest-risk case because the exploitable file path and contents are known/predictable, removing the "must know exact path" barrier that limits exploitation elsewhere.

What to do

Patch to the fixed versions:

• Bitbucket: 9.4.26, 10.2.8, 10.5.1
• Bamboo: 10.2.24, 12.1.12
• Confluence: 9.2.26, 10.2.19
• Crowd: 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Crucible: 4.9.15
• Fisheye: 4.9.15
• Jira Service Management: 5.12.40, 10.3.26, 11.3.12
• Jira Software: 9.12.40, 10.3.26, 11.3.12

If immediate patching isn't possible, disconnect the instance from the internet, or deploy the WAF rules detailed in Atlassian's advisory to block exploitation attempts (per Ganchev's guidance) as a stopgap.

Caveats

Both Atlassian and WatchTowr state there is no evidence of in-the-wild exploitation as of this report. WatchTowr notes the caveat as context rather than reassurance: ransomware groups and APTs have exploited this class of flaw before, and eight separate Atlassian vulnerabilities are already on CISA's KEV list.