Atlassian is urging administrators to patch CVE-2026-21589, a critical file-access vulnerability affecting eight self-hosted products. BleepingComputer and The Hacker News reported the warning on October 6, 2026, following the vendor's October 5 advisory. Atlassian rates the flaw 9.3 under CVSS 4.0.

The advisory covers Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. Atlassian says affected cloud services have already been patched and cloud customers need take no action.

According to Atlassian, an attacker needs no login to access specific files inside an affected application's web root. The attacker must know the exact filename and path; the flaw does not permit directory listing. Sensitive files in that location can increase exposure in some configurations.

Atlassian's Confluence security ticket lists versions 9.2.26 and 10.2.19 as fixed. Its Jira Software ticket lists 9.12.40, 10.3.26 and 11.3.12. Both direct administrators to upgrade affected installations; the Confluence ticket cautions that temporary blocking rules do not replace patching.

For systems that cannot be updated immediately, the vendor recommends restricting internet access until patches or mitigations are applied. Its advisory provides product-specific request-blocking guidance, including a firewall or reverse-proxy option. Bitbucket changes must cover cluster nodes, mirrors and mirror farm nodes.

Atlassian reports no evidence of exploitation in its cloud investigation, but cannot determine whether customer-managed instances were compromised. It directs local security teams to examine access logs for the traversal patterns in its advisory. Administrators should follow that investigation guidance alongside the prescribed updates.