High severity · published Oct 5, 2026
CVE-2026-21589
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
In wildKEV
7.5
CVSS
99.5%
EPSS
Yes
On KEV
Description
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 15, 2026
Federal remediation dueOct 18, 2026
Ransomware campaign useNot known
Affected products
Which versions
CO
Confluence · Atlassian
All other versions · source: vendor, NVD
BI
Bitbucket · Atlassian
4.6.0 through 8.14.6 · source: NVD
BD
Bamboo Data Center · Atlassian
All other versions · source: vendor
BD
Bitbucket Data Center · Atlassian
All other versions · source: vendor, NVD
CD
Crowd Data Center · Atlassian
All other versions · source: vendor
CD
Crucible Data Center · Atlassian
All other versions · source: vendor
FD
Fisheye Data Center · Atlassian
All other versions · source: vendor
JS
Jira Service Management Data Center · Atlassian
All other versions · source: vendor
JS
Jira Software Data Center · Atlassian
All other versions · source: vendor
BA
Bamboo · Atlassian
7.0.1 before 10.2.24; 11.0.0 before 12.1.12 · source: NVD
CR
Crowd · Atlassian
2.11.0 before 6.3.7; 7.0.0 before 7.0.3; 7.1.0 before 7.1.7; 7.2.0 before 7.2.4 · source: NVD
CR
Crucible · Atlassian
before 4.9.15 · source: NVD
In the news
VulnerabilityHigh
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria .
Aware of an exploited vulnerability not currently listed in t...
Oct 15, 2026·CISA Advisories
VulnerabilityHigh
[CISA KEV] CVE-2026-21589: Atlassian Multiple Products - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
MPMultiple ProductsCVE-2026-21589
Oct 15, 2026·CISA KEV
VulnerabilityCritical
Atlassian Vulnerability Comes Under Attack Hours After Details Go Public
Threat actors are exploiting CVE-2026-21589, a critical Atlassian flaw that can expose sensitive files across multiple Data Center products. Threat actors have started exploiting CVE-2026-21589 (CVSS score of 9.3), a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include […]
Oct 8, 2026·Security Affairs
VulnerabilityHigh
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
On October 5th, Atlassian published patches&#;x26;#;xc2;&#;x26;#;xa0;for multiple products to fix an "Arbitrary File Access" vulnerability &#;x26;#;x5b; CVE-2026-21589 &#;x26;#;x5d;. An attacker can read arbitrary files in the web application&#;x26;#;39;s directory, potentially exposing sensitive information such as configuration files. 
Oct 7, 2026·SANS Internet Storm Center
VulnerabilityCritical
Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)
One day after Atlassian released patches fixing a critical arbitrary file access vulnerability (CVE-2026-21589) in its self-managed Data Center products, and a few hours after watchTowr researchers published a technical rundown of the flaw, attackers have been spotted attempting to exploit it. CVE-2026-21589 PoC in action (Source: watchTowr) “Exploitation attempts have now started to hit our honeypot network,” threat intelligence vendor Previdian warned late Tuesday, and shared a list of attacker IPs. About CVE-2026-21589 CVE-2026-21589 … More →
The post Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589) appeared first on Help Net Security .
Oct 7, 2026·Help Net Security
VulnerabilityCritical
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.
The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software
Oct 7, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21589
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21589
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
jira.atlassian.com
https://jira.atlassian.com/browse/BAM-26567
jira.atlassian.com
https://jira.atlassian.com/browse/BSERV-20604
jira.atlassian.com
https://jira.atlassian.com/browse/CONFSERVER-104488
jira.atlassian.com
https://jira.atlassian.com/browse/CRUC-8741
jira.atlassian.com
https://jira.atlassian.com/browse/CWD-6610
jira.atlassian.com
https://jira.atlassian.com/browse/FE-7583
More from Confluence
9.8
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability