CVE-2026-21589
Summary
| CVE | CVE-2026-21589 |
|---|---|
| State | PUBLISHED |
| Assigner | atlassian |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-05 22:16:58 UTC |
| Updated | 2026-10-29 13:17:09 UTC |
| Description | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents. |
Risk And Classification
Primary CVSS: v4.0 9.3 CRITICAL from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.996640000 probability, percentile 0.999490000 (date 2026-11-04)
CISA KEV: Listed on 2026-10-15; due 2026-10-18; ransomware use Unknown
Problem Types: CWE-552 | Path Traversal (Arbitrary Read/Write) | CWE-552 CWE-552 Files or Directories Accessible to External Parties
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/C... |
| 4.0 | CNA | DECLARED | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H |
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
NoneAvailability
NoneSub Conf.
HighSub Integrity
HighSub Availability
HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known Exploited Vulnerability
| Vendor | Atlassian |
|---|---|
| Product | Multiple Products |
| Name | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability |
| Required Action | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| Notes | https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Atlassian | Bitbucket Data Center | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Atlassian | Bamboo Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Bamboo Data Center | unaffected Patch version 10.2.24 and later | Not specified |
| CNA | Atlassian | Bamboo Data Center | unaffected Patch version 12.1.12 and later | Not specified |
| CNA | Atlassian | Bitbucket Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Bitbucket Data Center | unaffected Patch version 10.2.8 and later | Not specified |
| CNA | Atlassian | Bitbucket Data Center | unaffected Patch version 10.5.1 and later | Not specified |
| CNA | Atlassian | Bitbucket Data Center | unaffected Patch version 9.4.26 and later | Not specified |
| CNA | Atlassian | Confluence Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Confluence Data Center | unaffected Patch version 10.2.19 and later | Not specified |
| CNA | Atlassian | Confluence Data Center | unaffected Patch version 9.2.26 and later | Not specified |
| CNA | Atlassian | Crowd Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 7.2.4 and later | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 7.1.7 and later | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 7.0.3 and later | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 6.3.7 and later | Not specified |
| CNA | Atlassian | Crucible Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Crucible Data Center | unaffected Patch version 4.9.15 and later | Not specified |
| CNA | Atlassian | Fisheye Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Fisheye Data Center | unaffected Patch version 4.9.15 and later | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | unaffected Patch version 11.3.12 and later | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | unaffected Patch version 10.3.26 and later | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | unaffected Patch version 5.12.40 and later | Not specified |
| CNA | Atlassian | Jira Software Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Jira Software Data Center | unaffected Patch version 11.3.12 and later | Not specified |
| CNA | Atlassian | Jira Software Data Center | unaffected Patch version 10.3.26 and later | Not specified |
| CNA | Atlassian | Jira Software Data Center | unaffected Patch version 9.12.40 and later | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| jira.atlassian.com/browse/BAM-26567 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| jira.atlassian.com/browse/CONFSERVER-104488 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| jira.atlassian.com/browse/FE-7583 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| jira.atlassian.com/browse/CWD-6610 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| jira.atlassian.com/browse/JRASERVER-79546 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | Third Party Advisory |
| jira.atlassian.com/browse/JSDSERVER-16809 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| jira.atlassian.com/browse/CRUC-8741 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| jira.atlassian.com/browse/BSERV-20604 | [email protected] | jira.atlassian.com | Issue Tracking, Mitigation, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.