UserGate Factor has identified a critical vulnerability, designated CVE-2026-21589, affecting Atlassian Data Center products. The flaw, which carries a CVSS 4.0 severity score of 9.3, stems from improper path validation in HTTP requests. It allows unauthenticated remote attackers to read specific files within the web application's root directory, provided the attacker knows the exact file path.
The vulnerability impacts a wide range of Atlassian enterprise solutions, including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. If left unpatched, the flaw could enable unauthorized access to sensitive information such as API keys, passwords, and internal documentation, potentially leading to a full-scale infrastructure compromise.
In response, UserGate has updated its uNGFW and uWAF security solutions with new signatures to detect and block exploitation attempts. The company advises administrators to apply official security updates from Atlassian immediately. If immediate patching is not feasible, users are urged to restrict external access to vulnerable systems and configure blocking rules within their security infrastructure.
