CISA has added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a flaw that lets unauthenticated attackers read files from the web root of eight Atlassian products: six Data Center products plus Crucible and Fisheye.
What Is It
CVE-2026-21589 is an arbitrary file access flaw (CWE-552: Files or Directories Accessible to External Parties). It lets an unauthenticated remote attacker read specific files inside the web application root directory of affected versions. The attacker must already know the target file's exact name and path, because the flaw does not allow listing directory contents. NVD published the record on 2026-10-05.
Why It Matters
- Confirmed active exploitation: CISA added the CVE to KEV on 2026-10-15. Federal agencies must remediate by 2026-10-18, so they have three days.
- No authentication needed: NVD scores it CVSS 3.1 7.5 (HIGH) (AV:N/AC:L/PR:N/UI:N, high confidentiality impact). Atlassian's CVSS 4.0 score is 9.3 (CRITICAL) and rates the subsequent-system impact as high.
- It depends on configuration: Atlassian says that in some configurations, sensitive files may be exposed, which makes the issue highly severe.
- Forensic triage required: KEV marks this entry for CISA's Forensics Triage Requirements.
- Whether ransomware campaigns use this flaw is listed as Unknown.
- A public watchTowr Labs repository for this CVE is listed in the NVD references.
What's Vulnerable
| Product | Introduced | Fixed versions |
|---|---|---|
| Bitbucket Data Center | ≥ 4.6.0 | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | ≥ 5.10.0 | 9.2.26, 10.2.19 |
| Crowd Data Center | ≥ 2.11.0 | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Jira Software Data Center | ≥ 7.1.0 | 9.12.40, 10.3.26, 11.3.12 |
| Jira Service Management Data Center | ≥ 3.1.0 | 5.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | ≥ 7.0.1 | 10.2.24, 12.1.12 |
| Crucible | — | 4.9.15 |
| Fisheye | — | 4.9.15 |
Patch Status
Atlassian has released fixed versions for every affected product (see table). CISA's required action:
- Apply mitigations according to vendor instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements.
- Follow BOD 26-04 guidance for cloud services. If no mitigations are available, stop using the product.
- Assess each asset's internet exposure and follow BOD 26-04 patching guidelines.
Organizations running affected Data Center instances, Crucible or Fisheye should upgrade to a fixed version before the 2026-10-18 due date.
Sources
- Atlassian Security Advisory: CVE-2026-21589
- CISA KEV Catalog: CVE-2026-21589
- NVD: CVE-2026-21589
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
- watchTowr Labs: watchTowr-vs-Atlassian-CVE-2026-21589
- Atlassian Jira trackers: BSERV-20604, CONFSERVER-104488, JRASERVER-79546, JSDSERVER-16809, BAM-26567, CWD-6610, CRUC-8741, FE-7583