Atlassian warns of critical file-access flaw in Jira, Confluence

CVE v události 11

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.3.

Jak se o tom psalo 11

1. 15. 10. 2026 · zachyceno 20:00 · CISA KEV US

   Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589)

   CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog. Affected product: Atlassian Multiple Products. Remediation due date: 2026-10-18.

2. 7. 10. 2026 16:59 · SANS Internet Storm Ctr. US

   Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)

   On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files. This directory traversal vulnerability is a little bit different from the textbook case. Atlassian products replace slashes with the pattern "::". To avoid this issue, but may, in some cases, undo this escape to access…

3. 7. 10. 2026 14:49 · BleepingComputer US

   Hackers exploit critical Atlassian flaw after public PoC release

   A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. [...]

4. 7. 10. 2026 14:11 · Rapid7 US

   CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

   Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3. An unauthenticated remote attacker who knows a target file's exact name and path can access it within…

5. 7. 10. 2026 09:52 · CERT-EU EU

   2026-015: Critical Vulnerability in Multiple Atlassian Products

   On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. CERT-EU strongly recommends upgrading all affected installations to a fixed version as soon as possible, starting with instances accessible from the internet. CERT-EU also recommends checking access…

6. 7. 10. 2026 · zachyceno 04:00 · NCSC-FI FI

   Atlassian: CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products

   Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv4.0: 9.3, CVEs: CVE-2026-21589, Summary: All versions of Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye are affected by this vulnerability. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory…

7. 6. 10. 2026 19:34 · BleepingComputer US nadpis události

   Atlassian warns of critical file-access flaw in Jira, Confluence

   Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]

8. 6. 10. 2026 18:47 · NCSC-NL NL

   NCSC-2026-0402 [1.00] [M/H] Kwetsbaarheid verholpen in Atlassian Data Center producten

   De kwetsbaarheid bevindt zich in meerdere producten binnen het Atlassian Data Center-platform, waaronder Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible en Fisheye. De kwetsbaarheid betreft een Arbitrary File Access-probleem waarmee ongeauthenticeerde aanvallers specifieke bestanden binnen de rootdirectory van de webapplicatie kunnen benaderen. Exploitatie vereist kennis van het exacte bestandspad en de bestandsnaam. Hierdoor kunnen mogelijk gevoelige…

9. 6. 10. 2026 15:44 · Cyber Centre Kanada CA

   Atlassian security advisory (AV26-1002)

   Serial number: AV26-1002 Date: October 5, 2026 As of October 5, 2026, Atlassian is affected by a vulnerability in the following products: Bamboo Data Center Version 10.2.4 and prior Version 12.1.12 and prior Bamboo Server All versions Bitbucket Data Center Version 10.2.8 and prior Version 10.5.1 and prior Version 9.4.26 and prior Bitbucket Server All versions Confluence Data Center Version 10.2.19 and prior Version 9.2.26 and prior Confluence Server All versions Crowd Data Center Version 6.3.7…

10. 6. 10. 2026 09:25 · CSIRT Itálie (ACN) IT

    Risolta vulnerabilità in prodotti Atlassian

    Aggiornamenti di sicurezza risolvono una vulnerabilità con gravità "critica" in diversi prodotti Atlassian. Tale vulnerabilità, qualora sfruttata, potrebbe permettere a un utente malintenzionato non autenticato di accedere a specifici file (purché conosca in anticipo nome e percorso del file) situati nella cartella "root" dell'applicazione web interessata.

11. 6. 10. 2026 · zachyceno 15:30 · CERT-FR – avis FR

    Multiples vulnérabilités dans les produits Atlassian (06 octobre 2026)

    De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données.