Atlassian Data Center

Security teams are being urged to patch two high-severity flaws. A pre-authentication file read in Atlassian Data Center products, tracked as CVE-2026-21589 with a CVSS score of 9.3, has reportedly been probed in the wild since October 6, with fixed Confluence builds including 9.2.26 and 10.2.19; admins are told to check logs for URL-encoded path traversal. Citrix NetScaler CVE-2026-107406, scoring 9.5, affects SAML SP and IdP configurations and is fixed in 14.1-73.46 and 13.1-64.29.

Atlassian has a critical vulnerability, tracked as EUVD-2026-92807, affecting a range of its enterprise products including Bitbucket Data Center, Crowd Server, Crucible Data Center, Confluence Data Center and Jira Service Management. The flaw carries a CVSS v3.1 severity score of 9.3 out of 10, putting it in the critical range. The advisory was updated on 5 October 2026, and security teams are being urged to check whether their deployments of the affected Atlassian products are exposed.

Atlassian's Data Center products — Bitbucket, Confluence and Jira — are affected by CVE-2026-21589, a critical vulnerability (CVSS 9.3) allowing unauthenticated arbitrary file access. Security researchers report exploitation attempts began within two hours of public proof-of-concept details being released, making rapid patching urgent for organizations running affected software.

Atlassian has released emergency patches for a critical arbitrary file access vulnerability, tracked as CVE-2026-21589, affecting eight of its Data Center products. The flaw is being actively exploited in the wild, with attackers using it to gain administrator-level access. Administrators are being urged to apply the patches immediately, as unpatched systems remain exposed to takeover.

Security researchers are flagging CVE-2026-21589, a critical vulnerability in self-hosted Atlassian Data Center products including Jira, Confluence, Bitbucket, Bamboo and Crowd. The flaw allows unauthenticated attackers to access arbitrary files, though they must know the exact file name or path since directory listing is not possible. Atlassian has released patched versions and reports no known exploitation so far. Administrators are urged to update their deployments promptly.

A critical vulnerability, CVE-2026-21589 with a CVSS score of 9.3, allows unauthenticated file reads in eight self-hosted Atlassian Data Center products, including Bitbucket, Confluence and Jira. Attackers must know a file's exact name or path, as there is no directory listing. Fixed versions have been released, and security experts urge administrators to restrict public access until they upgrade.

A new vulnerability, CVE-2026-21589, has been assigned a critical CVSS score of 9.3 in Atlassian Bamboo Data Center. The flaw is described as a path traversal issue allowing arbitrary read and write access on affected systems. Security teams running Bamboo deployments are being urged to review the advisory and patch promptly, as unpatched instances could allow attackers to read or modify files on the server.

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file-access vulnerability affecting self-hosted Data Center versions of Confluence, Jira and Bitbucket. The flaw could let attackers read sensitive files on affected servers. Atlassian is urging administrators to patch immediately. Security commentators are sharing the advisory and warning self-hosted deployments to act quickly.