VulnCheck Confirms Active Exploits: CERT-EU Demands Urgent Atlassian Fixes

Atlassian has published security updates to address a critical vulnerability that allows attackers to access files on servers running its Data Center products. The flaw, which enables arbitrary file access, is currently being exploited in the wild, according to security researcher VulnCheck. This active exploitation has prompted the European Union Agency for Cybersecurity (CERT-EU) to issue a strong recommendation for administrators to upgrade their systems immediately.

In plain English

An arbitrary file access vulnerability is a serious security hole that lets an attacker read or manipulate files on a server without proper authorization. In this case, the flaw affects the core infrastructure of Atlassian’s Data Center suite. Because the vulnerability allows direct access to files, it can lead to data theft, system compromise, or further attacks. The term "exploited in the wild" means that threat actors are actively using this weakness to target real-world systems, rather than just discussing it theoretically.

The background

The issue impacts eight specific products within Atlassian’s Data Center lineup: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. These are enterprise-grade tools widely used for project management, collaboration, and software development. On October 5, 2026, Atlassian issued a security advisory confirming the critical nature of the flaw and providing fixed versions of the software. The urgency of the situation was highlighted by Infosecurity Magazine, which reported that VulnCheck had identified ongoing exploitation attempts targeting these specific applications.

What changes now

CERT-EU has advised organizations to prioritize upgrading any Atlassian installations that are accessible from the internet. The agency emphasizes that internet-facing instances are at the highest risk and should be patched as soon as possible. Additionally, CERT-EU recommends that security teams review their access logs to look for signs that the vulnerability may have already been exploited. This step is crucial for determining if an attacker has already gained unauthorized access to sensitive files or system components.

What to do and how to stay safe: Atlassian

• Identify all instances of the eight affected Atlassian Data Center products in your environment.
• Prioritize patching for any servers that are exposed to the public internet.
• Review server access logs for unusual file access patterns or unauthorized requests.
• Monitor vendor communications for additional guidance or updates regarding this vulnerability.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Atlassian products are affected by this vulnerability?

The flaw affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.

Is this vulnerability currently being used by attackers?

Yes, VulnCheck reported that the critical vulnerability is being exploited in the wild.

What does CERT-EU recommend organizations do?

CERT-EU strongly recommends upgrading all affected installations to a fixed version as soon as possible, starting with internet-accessible instances, and checking access logs for signs of exploitation.