Atlassian has released fixes for a critical flaw affecting its self-hosted business software, including Jira, Confluence and Bitbucket. If your business runs these products on its own servers, they need updating now.

• What it is: A path traversal flaw (CVE-2026-21589, rated 9.3 out of 10) that lets someone on the internet reach files they should never see, without needing a login.
• Who is affected: Businesses running self-hosted (Data Center or Server) Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible or Fisheye. Atlassian Cloud customers are not affected, as the fix has already been applied.
• The risk: Attackers could read configuration files, passwords and access tokens, then use them to break further into your systems. At the time of writing, no active attacks had been confirmed, but flaws like this are often targeted quickly once details are public.
• What to do: Update each affected product to the fixed version listed in Atlassian's advisory, or to the latest release.

We recommend checking now whether your business hosts any of these products itself, and contacting us if you would like a hand confirming versions or applying the updates.

Source: Cyber Security Agency of Singapore alert AL-2026-135