CISA lists Atlassian file-access flaw CVE-2026-21589 as exploited
Original title: CISA KEV: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability — Atlassian Multiple Products (CVE-2026-21589)
Unauthenticated attackers can read a known file in the web root; federal remediation is due October 18, 2026.
CISA added CVE-2026-21589, an arbitrary file access flaw in several Atlassian Data Center products plus Crucible and Fisheye, to the Known Exploited Vulnerabilities catalog. An unauthenticated remote attacker who already knows a file's exact name and path can read that file under the web application root; directory listing is not possible. Fix versions are listed per product. Agencies must follow vendor mitigations and BOD 26-04 by October 18, 2026.
Unconfirmed: CISA lists known ransomware use as unknown and does not describe specific attacks.
- Bitbucket Data Center fixes are 9.4.26, 10.2.8 and 10.5.1.
- Confluence Data Center fixes are 9.2.26 and 10.2.19.
- Jira Software and Jira Service Management share fixes 10.3.26 and 11.3.12, plus older lines.
- Crowd, Bamboo, Crucible and Fisheye also have named fix versions.
- Known ransomware campaign use is listed as unknown.
Impact: Unauthenticated read of a known file in the web root
| Product | Affected | Fixed in |
|---|---|---|
| Atlassian Bitbucket Data Center | >= 4.6.0 | 9.4.26, 10.2.8, 10.5.1 |
| Atlassian Confluence Data Center | >= 5.10.0 | 9.2.26, 10.2.19 |
| Atlassian Crowd Data Center | >= 2.11.0 | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Atlassian Jira Software Data Center | >= 7.1.0 | 9.12.40, 10.3.26, 11.3.12 |
| Atlassian Jira Service Management Data Center | >= 3.1.0 | 5.12.40, 10.3.26, 11.3.12 |
| Atlassian Bamboo Data Center | >= 7.0.1 | 10.2.24, 12.1.12 |
| Atlassian Crucible | — | 4.9.15 |
| Atlassian Fisheye | — | 4.9.15 |
- 1.Apply the listed vendor fix versions or vendor mitigations.
- 2.Follow BOD 26-04; federal due date is October 18, 2026.
- 3.Stop using the product if mitigations are unavailable.
- CVEs
- CVE-2026-21589
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 9.3 | 99% | KEVPoC ×10 | KEV |
From the original article
1 min read at cisa.govThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.