🔴 Critical: Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
-
Atlassian has disclosed a critical vulnerability affecting 8 of its self-hosted Data Center products. Tracked as CVE-2026-21589, the flaw carries a severity rating of 9.3 out of 10 and was disclosed on October 5.
The issue allows an unauthenticated attacker to read specific files located in each product's web application root directory, meaning no login credentials are required to exploit it. There is a notable constraint, however: the attacker must already know the exact name and path of the target file and cannot browse or list the contents of the directory. This limits the scope of what can be accessed but does not reduce the severity rating, since sensitive files with predictable locations could still be exposed.
Key points:
- Affects 8 Atlassian Data Center products hosted by customers themselves
- CVE-2026-21589 is rated 9.3 out of 10
- No authentication is needed to exploit the flaw
- Attackers must know the exact filename and path; directory listing is not possible
- Disclosure occurred on October 5
Administrators running self-hosted Atlassian Data Center deployments should treat this as a priority and review Atlassian's advisory for the affected product list and available fixes.
Source: The Hacker News
Are any of your self-hosted Atlassian Data Center instances potentially exposed, and how are you planning to patch or mitigate?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login