Critical Atlassian Flaw Lets Unauthenticated Attackers Read Files Across Jira, Confluence and More

Atlassian has published an out-of-band critical advisory for CVE-2026-21589, which it describes as "Arbitrary File Access". Researchers at watchTowr Labs say this means an arbitrary file read: an attacker could read files they should not be able to reach. The vulnerability's severity score shows no requirement for authentication or special conditions, so an attacker would not need a login to try it.

The scale is the main concern. The flaw affects all previous versions of numerous Atlassian products, and watchTowr notes the number of exposed systems is likely in the six to seven-figure range rather than a few thousand. A quick internet search by the researchers found just under 700,000 instances of Confluence alone. Because so many products are affected, watchTowr concludes they likely share a common library or configuration. The researchers say they set out to test this against Bitbucket, Confluence and Jira by comparing vulnerable and patched versions to see what changed.

This summary is based on the opening of watchTowr's research, which does not yet cover the full technical detail. Organisations running Atlassian software on their own servers should treat the advisory as urgent and check which of their products are listed as affected.