Atlassian Multiple Products: Files or Directories Accessible to External Parties
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Is it being exploited: yes. CISA added it to its list of actively exploited flaws on 15 October 2026.
Who is affected: anyone running Atlassian Multiple Products. Check the vendor's advisory for the exact versions.
What to do: Apply mitigations in accordance with vendor instructions. CISA gave US federal agencies until 18 October 2026 to fix it.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.