NewsThe Hacker News2026-10-07 11:49 UTC

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software

CVE-2026-21589Sicherheitsluecke -- CVE-2026-21589
CVE-2026-21589Security Advisory 2026-015 — Critical Vulnerability in Multiple Atlassian Products
CVE-2026-21589Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Schwachstelle ermöglicht Offenlegung von Informationen
CVE-2026-21589h3.

Other advisories

CVE-2026-56819high
Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen
CVE-2026-21589high
Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Schwachstelle ermöglicht Offenlegung von Informationen
CVE-2026-21589none
Security Advisory 2026-015 — Critical Vulnerability in Multiple Atlassian Products
CVE-2026-47838high
Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen
CVE-2026-47838high
Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen
CVE-2026-77258none
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
CVE-2026-77250none
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
CVE-2026-77249none
MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

Other news entries

Newssecurityweek2026-10-08
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Newssans-isc-diary2026-10-07
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
Newsbleepingcomputer2026-10-07
Hackers exploit critical Atlassian flaw after public PoC release
Vulnerabilitybsi-cert-bund-wid2026-10-07
Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Schwachstelle ermöglicht Offenlegung von Informationen
Newssecurityweek2026-10-07
Atlassian Patches Critical Vulnerability Affecting 8 Products
Newscsoonline2026-10-07
Atlassian’s critical flaw turns eight enterprise products into one big security problem
Newsbleepingcomputer2026-10-06
Atlassian warns of critical file-access flaw in Jira, Confluence
Newsncsc-nl2026-10-06
NCSC-2026-0402 [1.00] [M/H] Kwetsbaarheid verholpen in Atlassian Data Center producten

Source: https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html

Linked advisories

More on Atlassian