Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
What's happening and what to do
An unauthenticated attacker can access files inside the web application's root directory without logging in, and this flaw is being actively exploited. Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Apply the vendor's update now and check for signs of compromise.
AI summary of the sources on this page. Regenerated when a source changes.
Signals over time
- 2026-10-15Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-10-18Federal patch deadline for US agencies.
- 2026-11-03 21:55First seen here.
Source text
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.