Atlassian Data Center file read, exploited (CVE-2026-21589) [PoC]

Actively exploited in the wild - CVE-2026-21589 is a critical arbitrary file access vulnerability in Atlassian Bitbucket, Confluence, Jira Software, Jira Service Management, Crowd, Bamboo Data Center, Crucible, and Fisheye that grants an unauthenticated remote attacker access to specific files inside the web application root directory. Fixed releases ship across all affected product lines; upgrade immediately.

Overview

CVE-2026-21589 is an arbitrary file access issue affecting a broad set of Atlassian Data Center and server products. An attacker with no credentials and no prior access can request specific files served from the web application root directory. The key constraint: the attacker must already know the exact filename and path. The vulnerability does not allow directory listing or enumeration, so an attacker cannot browse the filesystem. They must guess or already know a precise target.

Affected products and introduction points:

• Bitbucket Data Center: introduced 4.6.0, fixed in 9.4.26, 10.2.8, 10.5.1
• Confluence Data Center: introduced 5.10.0, fixed in 9.2.26, 10.2.19
• Crowd Data Center: introduced 2.11.0, fixed in 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Jira Software Data Center: introduced 7.1.0, fixed in 9.12.40, 10.3.26, 11.3.12
• Jira Service Management Data Center: introduced 3.1.0, fixed in 5.12.40, 10.3.26, 11.3.12
• Bamboo Data Center: introduced 7.0.1, fixed in 10.2.24, 12.1.12
• Crucible and Fisheye: fixed in 4.9.15

Impact

Because the flaw requires exact path knowledge, impact depends heavily on what an attacker can name. In some deployments, configuration files, backup artifacts, or environment files sit inside the web root and contain credentials, tokens, or connection strings. Where that is the case, a single unauthenticated request can leak secrets that unlock lateral movement into LDAP, databases, or SSO. CVSS scores this 9.3 critical: network-reachable, low complexity, no privileges, no user interaction. CISA has added it to the Known Exploited Vulnerabilities catalog, confirming real-world abuse.

Remediation and Mitigation

Upgrade every affected product to its fixed version listed above. There is no partial-patch path; each product line has its own target build. If immediate upgrade is not possible, restrict network access to the affected application so only trusted internal networks reach it, and audit the web application root for files that should never be web-served. Move secrets out of the web root as an interim control. Review logs for unauthenticated requests to unusual static paths, which may indicate probing or exploitation attempts.

Security Insight

This case shows how a “constrained” bug becomes critical once an adversary supplies the one missing piece: the file path. Atlassian’s own initial disclosure drew exploitation attempts within two hours, which mirrors the crowd-sourced pressure seen after past Atlassian advisories. For defenders, the lesson is that web-root hygiene is now a load-bearing security control: any secret placed there is one guessed path away from exposure.

Related: Atlassian CVE-2026-21589 exploited within 2 hours

Further Reading

• Atlassian CVE-2026-21589 exploited within 2 hours
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs