ATLASSIAN WARNS OF CRITICAL FILE ACCESS FLAW IN ITS DATACENTER PRODUCTS

Summary from the TLDR IT newsletter

Atlassian has issued an urgent warning regarding a critical 9.3-rated arbitrary file access vulnerability, tracked as CVE-2026-21589, that affects multiple Data Center products, including Bitbucket and Confluence. The flaw allows unauthenticated attackers to access specific files within the web application root directory if they know the exact filename and path. Atlassian has released fixed versions and recommends immediately patching affected installations. Organizations unable to patch should restrict external access or apply the published mitigations.