Unauthenticated arbitrary file read across eight Atlassian Data Center products (CVE-2026-21589)
A public Nuclei template and a watchTowr write-up containing a working request-level proof of concept were published within two days of Atlassian's advisory, so any unpatched internet-facing instance can now be probed with off-the-shelf tooling; no attacks are confirmed.
A path-traversal flaw lets an attacker with no credentials read specific files inside the web application root of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center, provided the exact file path is known. Atlassian rates it critical (CVSS 9.3) and says all versions prior to the fixed releases are affected, including end-of-life builds; depending on configuration the readable files can include sensitive material.
Affected: Atlassian Bamboo Data Center – all versions prior to 10.2.24 / 12.1.12; Atlassian Bitbucket Data Center – all versions prior to 9.4.26 / 10.2.8 / 10.5.1; Atlassian Confluence Data Center – all versions prior to the fixed releases in CONFSERVER-104488; Atlassian Jira Software Data Center – all versions prior to the fixed releases in JRASERVER-79546; Atlassian Jira Service Management Data Center – all versions prior to the fixed releases in JSDSERVER-16809; Atlassian Crowd Data Center – all versions prior to the fixed releases in CWD-6610; Atlassian Crucible – all versions prior to the fixed releases in CRUC-8741; Atlassian Fisheye – all versions prior to the fixed releases in FE-7583
How to Test
Compare the running build against the fixed versions: Bamboo DC must be 10.2.24 or 12.1.12+, Bitbucket DC must be 9.4.26, 10.2.8 or 10.5.1+; for Confluence, Jira Software, JSM, Crowd, Crucible and Fisheye, compare against the fix versions on the product's own advisory ticket (CONFSERVER-104488, JRASERVER-79546, JSDSERVER-16809, CWD-6610, CRUC-8741, FE-7583). Atlassian states all earlier versions, including end-of-life ones, are affected. Run the public Nuclei template (http/cves/2026/CVE-2026-21589.yaml) against your own instance to confirm exposure. Review reverse-proxy and application access logs for unauthenticated requests carrying traversal sequences that target files under the web application root, and for scanning patterns matching the watchTowr PoC request.
How to Patch
Upgrade to a fixed release: Bamboo Data Center 10.2.24 or 12.1.12; Bitbucket Data Center 9.4.26, 10.2.8 or 10.5.1; for Confluence, Jira Software, Jira Service Management, Crowd, Crucible and Fisheye, install the fixed version listed on the corresponding advisory ticket. Atlassian recommends end-of-life deployments move to a fixed LTS version or later. If you cannot patch immediately, apply Atlassian's temporary mitigation of removing the instance from external network reachability until it is upgraded.