CVE-2026-21589 needs no login: what unauthenticated access means for exposed Atlassian instances

NCSC-NL advisory NCSC-2026-0402 records CVE-2026-21589, a patched flaw in Atlassian Data Center products with a CVSS v4.0 score of 9.3. One property of the vulnerability drives much of its severity. The attacker does not need to authenticate.

What unauthenticated means here

The advisory describes an arbitrary file access issue where unauthenticated attackers can reach specific files inside the web application root directory. No credential, token, or valid user session is required. An internet-facing deployment is therefore reachable by anyone who can send an HTTP request and supply a valid path.

The single barrier: knowing the path

Exploitation requires knowledge of the exact file path and file name. That barrier is real but thin. Installation layouts, default configuration names, and documented static paths are widely known and often consistent across deployments. An attacker who has studied the product or who holds a copy of the same version can construct candidate paths without touching the target.

Confidentiality impact

A successful request returns file content that should stay behind an access control. Configuration data is the most likely target, and the advisory ties the risk to the confidentiality of data and configuration information managed by the affected applications.

Affected products

Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye, all on the Atlassian Data Center platform.

Exposure context

A ZoomEye query for Atlassian Confluence, Jira, and Bitbucket fingerprints returned 1,948,613 matching assets at the time of writing. Public product fingerprints show how many deployments are reachable from the internet. They do not indicate patch state.

Remediation and mitigations

Install the fixed product version named in the Atlassian advisory. If the update has to wait, place the affected applications behind network controls that stop untrusted requests, and review the files the web tier is able to serve. After the upgrade, verify the running build.

References

• NCSC-NL advisory NCSC-2026-0402
• Atlassian security advisory for CVE-2026-21589