CVE-2026-21589 allows unauthenticated remote attackers to read specific files within the web application root directory of affected Atlassian products. Attackers must know the exact filename and path, and cannot list directory contents. Sensitive information may be exposed depending on the files present.
CVE-2026-21589 | Atlassian Data Center Products Unauthenticated Arbitrary File Read Vulnerability
About this summary. This is a short excerpt from the description that Horizon3.ai published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-21589/
Source attribution: headline and facts are from Horizon3.ai (horizon3.ai). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Atlassian security advisory (AV26-1002)
Serial number: AV26-1002 Date: October 5, 2026 As of October 5, 2026, Atlassian is affected by a vulnerability in the following products: Bamboo Data Center Version…
Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)
Attackers who know where to look can read files from Atlassian Data Center installations without logging in, the company has warned. About CVE-2026-21589 CVE-2026-21589…
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's…
Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
Atlassian security advisory (AV26-1076)
Serial number: AV26-1076 Date: October 22, 2026 As of October 20, 2026, Atlassian is affected by vulnerabilities in the following products: Bamboo Data Center and Server…
U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog. The U.S.