Atlassian已告诉其用户立即修补其数据中心产品，以防止攻击者访问他们的文件。这家澳大利亚协作软件公司周一向用户发送了一封电子邮件，开头写着“需要采取行动”，并指向解释UTE-2026-21589的安全公告。Bitbucket、Confluence、Jira Service Management、Jira Software、Bamboo、Crowd、Crucible和Fisheye产品的数据中心版本中存在9.3级任意文件访问漏洞。
Atlassian has told its users to patch its datacenter products, pronto, to prevent attackers accessing their files. The Australian collaborationware company on Monday sent users an email that opens with the words “Action required” and points to a security bulletin that explains CVE-2026-21589. The 9.3-rated arbitrary file access vulnerability is present in the datacenter versions of its Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye products. Atlassian says the vulnerability “allows an unauthenticated attacker to access specific files within the web application root directory in affected versions.”That’s scary because Atlassian warns “In some configurations, there may be sensitive files present that increase your risk.”There’s also some good news in that attackers must know the exact filename and path to exploit the vulnerability, and the mess doesn’t allow anyone to see the contents of a directory. Another piece of good news is that Atlassian has updated its products – so users only need to find a change window in which to upgrade to a safe version of their software.
Atlassian表示，该漏洞“允许未经身份验证的攻击者访问受影响版本中Web应用程序根目录中的特定文件”。这很可怕，因为Atlassian警告说：“在某些配置中，可能存在敏感文件，这会增加您的风险。还有一些好消息，攻击者必须知道确切的文件名和路径才能利用该漏洞，并且混乱不允许任何人看到目录的内容。另一个好消息是Atlassian已经更新了它的产品-所以用户只需要找到一个更改窗口，在其中升级到他们的软件的安全版本。Atlassian建议那些不能尽快修补的人，如果可能的话，从互联网上删除他们的实例。该公司警告说：“应限制可访问公共互联网的收件箱，包括经过用户身份验证的收件箱，在您采取行动之前，应限制其访问外部网络。”它的建议还包括缓解措施和有关如何确定您的实例是否需要修复的建议。从数据中心产品转移到Atlassian云的用户无所事事，因为Atlassian修复了自己SaaS中的缺陷。这种情况证明了Atlassian在2020年停止开发低端服务器产品并要求用户转移到云的决定以及去年决定停止其数据中心软件的决定是正确的。
Atlassian advised those who can’t patch ASAP to remove their instances from the internet, if possible. “Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can take action,” the company warned. Its advisory also includes mitigations and advice on how to determine if your instances need the fix. Users who made the move from datacenter products to the Atlassian cloud have nothing to do, as Atlassian fixed the flaws in its own SaaS. That state of affairs rather vindicates Atlassian’s 2020 decision to stop developing its low-end server products and require users to shift into its cloud, and last year’s sequel in which it decided to discontinue its datacenter software, too.
Atlassian承认，它并没有使迁移变得容易，因为它以某种方式发布了一个比早期版本更糟糕的提升和转换工具。2026年3月，Atlassian裁员10%。当时该公司的股价持续了一年的下滑，因为专家们认为它可能会成为SaaSPoconsse的受害者，该理论认为人工智能将取代商业软件。自那以来，Atlassian代币的价格已经上涨了两倍，这表明投资者更有信心该公司使用人工智能为工作流程提供动力的计划代表了LLM无法跨越的护城河。®
Atlassian admitted it hasn’t made that migration easy, because it somehow released a lift and shift tool that was worse than an earlier version. In March 2026, Atlassian axed ten percent of staff. The company’s share price was on a year-long slide at the time, as pundits suggested it might fall victim to the SaaSPocalypse, a theory that AI would replace business software. The price of Atlassian scrip has tripled since then, suggesting investors are more confident the company’s plan to use AI to power workflows represents a moat LLMs cannot cross. ®