Atlassian Multiple Products

CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 15 Oct 2026, 10 days after the CVE record was published.

How likely is exploitation in the next 30 days?

99.5%

EPSS score, percentile 99.9 of all scored records

How severe?

9.3 Critical

CVSS v4.0 base score, given by the CNA

What should I do?

CISA deadline 18 Oct 2026. Apply mitigations in accordance with vendor instructions … Full text

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

All other versions
All other versions
All other versions
All other versions
All other versions
All other versions

and 2 more in the table below

Unaffected Patch version 10.2.24 and later; Patch version 12.1.12 and later; Patch version 10.2.8 and later; Patch version 10.5.1 and later; Patch version 9.4.26 and later; Patch version 10.2.19 and later; and 13 more

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date for this action: 18 October 2026.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

Atlassian Bamboo Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 10.2.24 and later
Unaffected	Patch version 12.1.12 and later

Atlassian Bitbucket Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 10.2.8 and later
Unaffected	Patch version 10.5.1 and later
Unaffected	Patch version 9.4.26 and later

Atlassian Confluence Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 10.2.19 and later
Unaffected	Patch version 9.2.26 and later

Atlassian Crowd Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 7.2.4 and later
Unaffected	Patch version 7.1.7 and later
Unaffected	Patch version 7.0.3 and later
Unaffected	Patch version 6.3.7 and later

Atlassian Crucible Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 4.9.15 and later

Atlassian Fisheye Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 4.9.15 and later

Atlassian Jira Service Management Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 11.3.12 and later
Unaffected	Patch version 10.3.26 and later
Unaffected	Patch version 5.12.40 and later

Atlassian Jira Software Data Center
Status	Versions
Affected	All other versions
Unaffected	Patch version 11.3.12 and later
Unaffected	Patch version 10.3.26 and later
Unaffected	Patch version 9.12.40 and later

Versions the record lists as unaffected: Patch version 10.2.24 and later, Patch version 12.1.12 and later, Patch version 10.2.8 and later, Patch version 10.5.1 and later, Patch version 9.4.26 and later, Patch version 10.2.19 and later, Patch version 9.2.26 and later, Patch version 7.2.4 and later.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalog on 15 Oct 2026.
CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
The due date CISA sets for the required action is 18 Oct 2026.
The CVE record was published on 5 Oct 2026, 10 days before it was added to KEV.
The CVE record carries a CVSS v4.0 base score of 9.3 (Critical), given by its CNA.
FIRST's EPSS model puts the probability of exploitation in the next 30 days at 99.5% (percentile 99.9), as of 28 Oct 2026.
CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

CWE-552: Files or Directories Accessible to External Parties

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

Date	Event
5 Oct 2026	CVE record published
15 Oct 2026	Added to CISA KEV
18 Oct 2026	CISA due date for the required action
19 Oct 2026	CVE record last updated

References

More exploited Atlassian vulnerabilities

CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability (added 12 Nov 2024)
CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability (added 24 Jan 2024)
CVE-2023-22518: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (added 7 Nov 2023)
CVE-2023-22515: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability (added 5 Oct 2023)
CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability (added 30 Sep 2022)
CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability (added 29 Jul 2022)