Atlassian Issues Critical Advisory for Arbitrary File-Access Vulnerability in Data Center Products

Atlassian has issued a security advisory warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products. The affected products include Confluence, Jira, and Bitbucket. The vulnerability was disclosed on 2026-10-06 and impacts self-hosted deployments of these platforms. Atlassian states that the flaw could allow an attacker to access arbitrary files on the server, potentially leading to data exfiltration or system compromise. The company has released security updates to address the vulnerability and recommends that all customers running affected Data Center versions apply the latest patches immediately. As of the advisory date, details of active exploitation in the wild were not specified, but the severity of the flaw warrants urgent attention. Organizations are advised to check their current version against the patched releases provided by Atlassian and update accordingly to mitigate the risk.