CVE-2026-21589
Updated
- CVSS 4.0
- 9.3 CRITICAL
- EPSS
- 99.7% (100th pct)
- CISA KEV
- Exploited
- Published
- 2026-10-05
- Weakness
- CWE-552
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA notes
https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589
Description
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Key Findings
as of 2026-11-12- CISA added CVE-2026-21589 to the KEV catalog 10 days after its CVE record was published. The median for entries added in 2026 so far is 12 days.
- It is one of 14 Atlassian entries in the CISA KEV catalog, and the only one added in 2026.
- Its current EPSS score (99.7%) is higher than that of 89% of CISA KEV entries.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:HOpen in CVSS calculator Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Atlassian | Atlassian Bamboo Data Center | All other versions Patch version 10.2.24 and later (unaffected) Patch version 12.1.12 and later (unaffected) |
| Atlassian | Atlassian Bitbucket Data Center | All other versions Patch version 10.2.8 and later (unaffected) Patch version 10.5.1 and later (unaffected) Patch version 9.4.26 and later (unaffected) |
| Atlassian | Atlassian Confluence Data Center | All other versions Patch version 10.2.19 and later (unaffected) Patch version 9.2.26 and later (unaffected) |
| Atlassian | Atlassian Crowd Data Center | All other versions Patch version 7.2.4 and later (unaffected) Patch version 7.1.7 and later (unaffected) Patch version 7.0.3 and later (unaffected) Patch version 6.3.7 and later (unaffected) |
| Atlassian | Atlassian Crucible Data Center | All other versions Patch version 4.9.15 and later (unaffected) |
| Atlassian | Atlassian Fisheye Data Center | All other versions Patch version 4.9.15 and later (unaffected) |
| Atlassian | Atlassian Jira Service Management Data Center | All other versions Patch version 11.3.12 and later (unaffected) Patch version 10.3.26 and later (unaffected) Patch version 5.12.40 and later (unaffected) |
| Atlassian | Atlassian Jira Software Data Center | All other versions Patch version 11.3.12 and later (unaffected) Patch version 10.3.26 and later (unaffected) Patch version 9.12.40 and later (unaffected) |
References
8 linksOther references
- https://jira.atlassian.com/browse/BAM-26567
- https://jira.atlassian.com/browse/BSERV-20604
- https://jira.atlassian.com/browse/CONFSERVER-104488
- https://jira.atlassian.com/browse/CRUC-8741
- https://jira.atlassian.com/browse/CWD-6610
- https://jira.atlassian.com/browse/FE-7583
- https://jira.atlassian.com/browse/JRASERVER-79546
- https://jira.atlassian.com/browse/JSDSERVER-16809
Record Details
- Published
- 2026-10-05
- Last updated
- 2026-10-29
- Assigner (CNA)
- atlassian
- Credited to
- -
More from Atlassian
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian Jira Server and Data Center Path Traversal Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.