06 October 2026
Reference: CVE-2026-21589
1. What is being reported?
The vulnerability affects multiple Atlassian products used for team collaboration and project management. It allows someone outside your organisation, without any login, to view specific files stored within the software’s main directory if they already know the exact file name and path. However, attackers cannot browse or list all files, only access known ones.
2. What this means in plain English
If your organisation uses any of these Atlassian Data Center products, there is a risk that sensitive files could be accessed by unauthorised people. This could include internal documents or configuration files that might help attackers further compromise your systems. The risk depends on whether such files are stored and how well your system is configured.
3. Could this affect a small business?
Small businesses or charities using Atlassian Data Center versions mentioned in the report could be affected. Those not using these specific products or using cloud-hosted versions are unlikely to be impacted. If you are unsure whether you use these products or versions, check with your IT provider.
4. What to do now
- Check if your organisation uses any of the affected Atlassian Data Center products and their versions.
- Contact your IT provider or software supplier to confirm if your systems are vulnerable.
- Apply the security updates or patches provided by Atlassian as soon as possible.
- Review file storage and access permissions within these applications to reduce exposure.
5. Ask your IT provider
Can you confirm if our Atlassian Data Center products are affected by CVE-2026-21589, and have the necessary security updates been applied?
6. Bottom line
If you use certain Atlassian Data Center products, ensure they are updated promptly to prevent unauthorised file access.
Information based on NVD, CISA KEV, and reputable security news reporting.