CVE-2026-21589

9.3

CRITICAL CVSS 4.0

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability - [Actively Exploited]

Overview

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Details

INFO

Published Date :

Oct. 5, 2026, 10:16 p.m.

Last Modified :

Oct. 26, 2026, 10:10 a.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Oct 18, 2026

Alert Date: Oct 15, 2026 | 11 days ago

Description :

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Required Action :

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Known Ransomware Campaign Use:

Unknown

Notes :

https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589

Impact

Affected Products

The following products are affected by CVE-2026-21589 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Atlassian	crucible
2	Atlassian	confluence_server
3	Atlassian	fisheye
4	Atlassian	crowd
5	Atlassian	bitbucket_data_center
6	Atlassian	bitbucket_server
7	Atlassian	jira_data_center
8	Atlassian	jira_service_desk
9	Atlassian	jira_service_management
10	Atlassian	bamboo
11	Atlassian	confluence_data_center
12	Atlassian	bamboo_data_center
13	Atlassian	bamboo_server
14	Atlassian	jira_software_data_center

: Total Affected Vendor : 1 | Products : 14

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS		134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1	HIGH	[email protected]
CVSS 4.0	CRITICAL	[email protected]

Solution

Update affected products to patched versions to prevent arbitrary file access.

Update Bitbucket Data Center to a fixed version.
Update Confluence Data Center to a fixed version.
Update Crowd Data Center to a fixed version.
Update Jira Data Center products to fixed versions.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-21589.

URL	Resource
https://jira.atlassian.com/browse/BAM-26567	Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/BSERV-20604	Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-104488	Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8741	Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/CWD-6610	Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/FE-7583	Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-79546	Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/JSDSERVER-16809	Issue Tracking Mitigation Vendor Advisory
https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589	Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-21589 is associated with the following CWEs:

CWE-552: Files or Directories Accessible to External Parties

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-21589 weaknesses.

CAPEC-150: Collect Data from Common Resource Locations Collect Data from Common Resource Locations CAPEC-639: Probe System Files Probe System Files

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-21589 vulnerability anywhere in the article.

The Hacker News

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone d ...

Published Date: Oct 12, 2026 (2 weeks ago)

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity - Week 41 (2026)

The Good | Federal Authorities Disrupt Cybercrime Syndicates & Courts Sentence Dark Web Co-FounderJordanian authorities detained Saif al-Din Khader, a suspected member of the ShinyHunters extortion gr ...

Published Date: Oct 09, 2026 (2 weeks, 2 days ago)

TheCyberThrone

Critical NetScaler RCE Vulnerability CVE-2026-107406

Executive SummaryCitrix has disclosed CVE-2026-107406, a critical memory overflow vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway under specific SAML authentication configurations. ...

Published Date: Oct 09, 2026 (2 weeks, 3 days ago)

TheCyberThrone

CVE-2026-102255: Critical Pre-Auth SSRF Vulnerability in SonicWall SMA1000

A new critical vulnerability in SonicWall SMA1000 appliances deserves immediate attention from organizations using the platform as an internet-facing remote-access gateway.Tracked as CVE-2026-102255, ...

Published Date: Oct 08, 2026 (2 weeks, 4 days ago)

TheCyberThrone

CVE-2026-21589: Critical Atlassian Flaw Enables Unauthenticated File Access

Executive SummaryAtlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting multiple Atlassian Data Center products.The vulnerability carries a CVSS v4.0 score of ...

Published Date: Oct 07, 2026 (2 weeks, 5 days ago)

security.nl

'Kritiek Atlassian-lek dat toegang tot bestanden geeft misbruikt bij aanvallen'

Een kritieke kwetsbaarheid in producten van Atlassian, waardoor aanvallers toegang tot bestanden en gevoelige informatie kunnen krijgen, wordt misbruikt bij aanvallen, zo meldt cybersecuritybedrijf Pr ...

Published Date: Oct 07, 2026 (2 weeks, 5 days ago)

The Hacker News

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary ...

Published Date: Oct 07, 2026 (2 weeks, 5 days ago)

security.nl

Atlassian waarschuwt voor kritiek lek dat aanvallers toegang tot bestanden geeft

Softwarebedrijf Atlassian waarschuwt voor een kritieke kwetsbaarheid in verschillende producten waardoor ongeauthenticeerde aanvallers toegang tot willekeurige bestanden in de root directory van de we ...

Published Date: Oct 06, 2026 (2 weeks, 6 days ago)

The Hacker News

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. T ...

Published Date: Oct 06, 2026 (2 weeks, 6 days ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-21589 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

CVE Translated by [email protected]

Oct. 26, 2026

Action	Type	Old Value	New Value
Added	Translation		Title: Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center y Jira Software Data Center de Atlassian, Description: Esta es una vulnerabilidad en Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible y Fisheye. Esta vulnerabilidad de Acceso Arbitrario a Archivos permite a un atacante no autenticado acceder a archivos específicos dentro del directorio raíz de la aplicación web en las versiones afectadas. La explotación requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo; esta vulnerabilidad no permite a los atacantes enumerar o listar el contenido del directorio. En algunas configuraciones, puede haber archivos sensibles que la hacen altamente severa. Esta vulnerabilidad permite a un atacante remoto no autenticado acceder a archivos específicos dentro del directorio raíz de la aplicación web en las versiones afectadas. La vulnerabilidad debe abordarse para las versiones afectadas de: -- Bitbucket Data Center, introducida en la versión 4.6.0 o posteriores, con versiones corregidas: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introducida en la versión 5.10.0 o posteriores, con versiones corregidas: 9.2.26, 10.2.19 -- Crowd Data Center, introducida en la versión 2.11.0 o posteriores, con versiones corregidas: 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introducida en la versión 7.1.0 o posteriores, con versiones corregidas: 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introducida en la versión 3.1.0 o posteriores, con versiones corregidas: 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center, versiones 7.0.1 o posteriores, con versiones corregidas: 10.2.24, 12.1.12 -- Crucible, con versiones corregidas: 4.9.15 -- Fisheye, con versión corregida: 4.9.15 -- La explotación requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo. La vulnerabilidad no incluye la capacidad de enumerar o listar el contenido del directorio.

Modified Analysis by [email protected]

Oct. 19, 2026

Action	Type	New Value
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Added	CPE Configuration	OR cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 10.3.0 up to (excluding) 10.5.1 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 9.5.0 up to (excluding) 10.2.8 cpe:2.3:a:atlassian:bitbucket_server::::::::* versions from (including) 4.6.0 up to (including) 8.14.6 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 7.17.0 up to (excluding) 9.4.26
Added	CPE Configuration	OR cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 5.10.0 up to (excluding) 9.2.26 cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 9.3.0 up to (excluding) 10.2.19
Added	CPE Configuration	OR cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 2.11.0 up to (excluding) 6.3.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.0.0 up to (excluding) 7.0.3 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.1.0 up to (excluding) 7.1.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.2.0 up to (excluding) 7.2.4
Added	CPE Configuration	OR cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 7.1.0 up to (excluding) 9.12.40 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 9.13.0 up to (excluding) 10.3.26
Added	CPE Configuration	OR cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 5.13.0 up to (excluding) 10.3.26 cpe:2.3:a:atlassian:jira_service_desk:::::data_center::: versions from (including) 3.1.0 up to (including) 4.13.27 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 4.14.0 up to (excluding) 5.12.40
Added	CPE Configuration	OR cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 7.0.1 up to (excluding) 10.2.24 cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 11.0.0 up to (excluding) 12.1.12
Added	CPE Configuration	OR cpe:2.3:a:atlassian:crucible::::::::* versions up to (excluding) 4.9.15
Added	CPE Configuration	OR cpe:2.3:a:atlassian:fisheye::::::::* versions up to (excluding) 4.9.15
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/BAM-26567 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/BSERV-20604 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/CONFSERVER-104488 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/CRUC-8741 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/CWD-6610 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/FE-7583 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/JRASERVER-79546 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	CISA-ADP: https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 Types: Third Party Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/JSDSERVER-16809 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 Types: US Government Resource

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 19, 2026

Action	Type	New Value
Added	CWE	CWE-552
Added	Reference	https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
Added	Reference	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589
Added	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T00:00:00+00:00'}

CVE Modified by [email protected]

Oct. 19, 2026

Action	Type	Old Value	New Value
Changed	Description	Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.	This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Added	CVSS V4.0		AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Added	Affected		New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/21xxx/CVE-2026-21589.json">CVE-2026-21589</a>
Added	Reference		https://jira.atlassian.com/browse/BAM-26567
Added	Reference		https://jira.atlassian.com/browse/BSERV-20604
Added	Reference		https://jira.atlassian.com/browse/CONFSERVER-104488
Added	Reference		https://jira.atlassian.com/browse/CRUC-8741
Added	Reference		https://jira.atlassian.com/browse/CWD-6610
Added	Reference		https://jira.atlassian.com/browse/FE-7583
Added	Reference		https://jira.atlassian.com/browse/JRASERVER-79546
Added	Reference		https://jira.atlassian.com/browse/JSDSERVER-16809

CVE Unrejected by [email protected]

Oct. 19, 2026

Action	Type	Old Value	New Value

CVE Rejected by [email protected]

Oct. 16, 2026

Action	Type	Old Value	New Value

CVE Modified by [email protected]

Oct. 16, 2026

Action	Type	Old Value	New Value
Changed	Description	This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.	Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.
Removed	CVSS V4.0	Atlassian: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Removed	CVSS V3.1	NIST: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Removed	CVSS V3.1	nvd-ai-agent-0.4.0-gemma-4-31B-it: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Removed	CWE	CISA-ADP: CWE-552
Removed	CWE	nvd-ai-agent-0.4.0-gemma-4-31B-it: CWE-22
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 10.3.0 up to (excluding) 10.5.1 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 9.5.0 up to (excluding) 10.2.8 cpe:2.3:a:atlassian:bitbucket_server::::::::* versions from (including) 4.6.0 up to (including) 8.14.6 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 7.17.0 up to (excluding) 9.4.26
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 5.10.0 up to (excluding) 9.2.26 cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 9.3.0 up to (excluding) 10.2.19
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 2.11.0 up to (excluding) 6.3.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.0.0 up to (excluding) 7.0.3 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.1.0 up to (excluding) 7.1.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.2.0 up to (excluding) 7.2.4
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 7.1.0 up to (excluding) 9.12.40 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 9.13.0 up to (excluding) 10.3.26
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 5.13.0 up to (excluding) 10.3.26 cpe:2.3:a:atlassian:jira_service_desk:::::data_center::: versions from (including) 3.1.0 up to (including) 4.13.27 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 4.14.0 up to (excluding) 5.12.40
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 7.0.1 up to (excluding) 10.2.24 cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 11.0.0 up to (excluding) 12.1.12
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:crucible::::::::* versions up to (excluding) 4.9.15
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:fisheye::::::::* versions up to (excluding) 4.9.15
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 10.2.8 up to (excluding) 10.5.1 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 4.6.0 up to (excluding) 9.4.26 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 9.4.26 up to (excluding) 10.2.8
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 5.10.0 up to (excluding) 9.2.26 cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 9.2.26 up to (excluding) 10.2.19
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 2.11.0 up to (excluding) 6.3.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 6.3.7 up to (excluding) 7.0.3 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.0.3 up to (excluding) 7.1.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.1.7 up to (excluding) 7.2.4
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 10.3.26 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 7.1.0 up to (excluding) 9.12.40 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 9.12.40 up to (excluding) 10.3.26
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:jira_service_management::::::::* versions from (including) 10.3.26 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_service_management::::::::* versions from (including) 3.1.0 up to (excluding) 5.12.40 cpe:2.3:a:atlassian:jira_service_management::::::::* versions from (including) 5.12.40 up to (excluding) 10.3.26
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 10.2.24 up to (excluding) 12.1.12 cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 7.0.1 up to (excluding) 10.2.24
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:crucible::::::::* versions up to (excluding) 4.9.15
Removed	CPE Configuration	OR cpe:2.3:a:atlassian:fisheye::::::::* versions up to (excluding) 4.9.15
Added	Affected		Affected value removed. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/21xxx/CVE-2026-21589.json">CVE-2026-21589</a>
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/BAM-26567
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/BSERV-20604
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/CONFSERVER-104488
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/CRUC-8741
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/CWD-6610
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/FE-7583
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/JRASERVER-79546
Removed	Reference	Atlassian: https://jira.atlassian.com/browse/JSDSERVER-16809
Removed	Reference	CISA-ADP: https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
Removed	Reference	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/BAM-26567
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/BSERV-20604
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/CONFSERVER-104488
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/CRUC-8741
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/CWD-6610
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/FE-7583
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/JRASERVER-79546
Removed	Reference	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/JSDSERVER-16809
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/BAM-26567 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/BSERV-20604 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/CONFSERVER-104488 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/CRUC-8741 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/CWD-6610 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/FE-7583 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/JRASERVER-79546 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	Atlassian: https://jira.atlassian.com/browse/JSDSERVER-16809 Types: Issue Tracking, Mitigation, Vendor Advisory
Removed	Reference Type	CISA-ADP: https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 Types: Third Party Advisory
Removed	Reference Type	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 Types: US Government Resource
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/BAM-26567 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/BSERV-20604 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/CONFSERVER-104488 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/CRUC-8741 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/CWD-6610 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/FE-7583 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/JRASERVER-79546 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	Reference Type	nvd-ai-agent-0.4.0-gemma-4-31B-it: https://jira.atlassian.com/browse/JSDSERVER-16809 Types: Issue Tracking, Issue Tracking, Mitigation, Mitigation, Vendor Advisory, Vendor Advisory
Removed	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T00:00:00+00:00'}

Modified Analysis by [email protected]

Oct. 16, 2026

Action	Type	Old Value	New Value
Changed	CPE Configuration	OR cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 3.1.0 up to (excluding) 5.12.40 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 5.13.0 up to (excluding) 10.3.26	OR cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 5.13.0 up to (excluding) 10.3.26 cpe:2.3:a:atlassian:jira_service_desk:::::data_center::: versions from (including) 3.1.0 up to (including) 4.13.27 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 4.14.0 up to (excluding) 5.12.40

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 16, 2026

Action	Type	Old Value	New Value
Removed	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T17:42:00.925867Z'}
Added	SSVC		{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T00:00:00+00:00'}

Initial Analysis by [email protected]

Oct. 15, 2026

Action	Type	New Value
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Added	CPE Configuration	OR cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 10.3.0 up to (excluding) 10.5.1 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 9.5.0 up to (excluding) 10.2.8 cpe:2.3:a:atlassian:bitbucket_server::::::::* versions from (including) 4.6.0 up to (including) 8.14.6 cpe:2.3:a:atlassian:bitbucket_data_center::::::::* versions from (including) 7.17.0 up to (excluding) 9.4.26
Added	CPE Configuration	OR cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 5.10.0 up to (excluding) 9.2.26 cpe:2.3:a:atlassian:confluence_data_center::::::::* versions from (including) 9.3.0 up to (excluding) 10.2.19
Added	CPE Configuration	OR cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 2.11.0 up to (excluding) 6.3.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.0.0 up to (excluding) 7.0.3 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.1.0 up to (excluding) 7.1.7 cpe:2.3:a:atlassian:crowd::::::::* versions from (including) 7.2.0 up to (excluding) 7.2.4
Added	CPE Configuration	OR cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 7.1.0 up to (excluding) 9.12.40 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_data_center::::::::* versions from (including) 9.13.0 up to (excluding) 10.3.26
Added	CPE Configuration	OR cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 10.4.0 up to (excluding) 11.3.12 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 3.1.0 up to (excluding) 5.12.40 cpe:2.3:a:atlassian:jira_service_management:::::data_center::: versions from (including) 5.13.0 up to (excluding) 10.3.26
Added	CPE Configuration	OR cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 7.0.1 up to (excluding) 10.2.24 cpe:2.3:a:atlassian:bamboo::::::::* versions from (including) 11.0.0 up to (excluding) 12.1.12
Added	CPE Configuration	OR cpe:2.3:a:atlassian:crucible::::::::* versions up to (excluding) 4.9.15
Added	CPE Configuration	OR cpe:2.3:a:atlassian:fisheye::::::::* versions up to (excluding) 4.9.15
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/BAM-26567 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/BSERV-20604 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/CONFSERVER-104488 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/CRUC-8741 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/CWD-6610 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/FE-7583 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/JRASERVER-79546 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	Atlassian: https://jira.atlassian.com/browse/JSDSERVER-16809 Types: Issue Tracking, Mitigation, Vendor Advisory
Added	Reference Type	CISA-ADP: https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 Types: Third Party Advisory
Added	Reference Type	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 Types: US Government Resource

CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

Oct. 15, 2026

Action	Type	New Value
Added	Date Added	2026-10-15
Added	Due Date	2026-10-15
Added	Required Action	2026-10-15
Added	Vulnerability Name	2026-10-15

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 15, 2026

Action	Type	Old Value	New Value
Added	Reference		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589
Removed	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T14:10:40.958067Z'}
Added	SSVC		{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T17:42:00.925867Z'}

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 15, 2026

Action	Type	Old Value	New Value
Removed	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-10-14T16:11:48.371618Z'}
Added	SSVC		{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T14:10:40.958067Z'}

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 14, 2026

Action	Type	Old Value	New Value
Removed	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-07T13:04:54.917548Z'}
Added	SSVC		{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-10-14T16:11:48.371618Z'}

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 07, 2026

Action	Type	Old Value	New Value
Added	Reference		https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
Removed	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-10-06T18:08:49.205538Z'}
Added	SSVC		{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-07T13:04:54.917548Z'}

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 06, 2026

Action	Type	Old Value	New Value
Removed	SSVC	{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-10-06T13:51:09.129268Z'}
Added	SSVC		{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-10-06T18:08:49.205538Z'}

CVE Modified by [email protected]

Oct. 06, 2026

Action	Type	Old Value	New Value
Changed	Description	h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents.	This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Added	Affected		Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/21xxx/CVE-2026-21589.json">CVE-2026-21589</a>

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Oct. 06, 2026

Action	Type	Old Value	New Value
Added	CWE		CWE-552
Added	SSVC		{'id': 'CVE-2026-21589', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-10-06T13:51:09.129268Z'}

New CVE Received by [email protected]

Oct. 05, 2026

Action	Type	New Value
Added	Description	h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents.
Added	CVSS V4.0	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Added	Affected	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/21xxx/CVE-2026-21589.json">CVE-2026-21589</a>
Added	Reference	https://jira.atlassian.com/browse/BAM-26567
Added	Reference	https://jira.atlassian.com/browse/BSERV-20604
Added	Reference	https://jira.atlassian.com/browse/CONFSERVER-104488
Added	Reference	https://jira.atlassian.com/browse/CRUC-8741
Added	Reference	https://jira.atlassian.com/browse/CWD-6610
Added	Reference	https://jira.atlassian.com/browse/FE-7583
Added	Reference	https://jira.atlassian.com/browse/JRASERVER-79546
Added	Reference	https://jira.atlassian.com/browse/JSDSERVER-16809

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.

Browse by Apps

CVE-2026-21589

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability - [Actively Exploited]

Description

INFO

Oct. 5, 2026, 10:16 p.m.

Oct. 26, 2026, 10:10 a.m.

Yes !

[email protected]

CISA KEV (Known Exploited Vulnerabilities)

Affected Products

CVSS Scores

Solution

References to Advisories, Solutions, and Tools

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

The Good, the Bad and the Ugly in Cybersecurity - Week 41 (2026)

Critical NetScaler RCE Vulnerability CVE-2026-107406

CVE-2026-102255: Critical Pre-Auth SSRF Vulnerability in SonicWall SMA1000

CVE-2026-21589: Critical Atlassian Flaw Enables Unauthenticated File Access

'Kritiek Atlassian-lek dat toegang tot bestanden geeft misbruikt bij aanvallen'

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Atlassian waarschuwt voor kritiek lek dat aanvallers toegang tot bestanden geeft

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

CVE Translated by [email protected]

Modified Analysis by [email protected]

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by [email protected]

CVE Unrejected by [email protected]

CVE Rejected by [email protected]

CVE Modified by [email protected]

Modified Analysis by [email protected]

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Initial Analysis by [email protected]

CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by [email protected]

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

New CVE Received by [email protected]

Vulnerability Scoring Details

Base CVSS Score: 9.3

Base CVSS Score: 7.5

Cookie Preferences