CVE-2026-21589

CRITICAL CISA KEV 13 PoCs

ACT NOW Priority: 9.25 BB Relevance: 99/100

Published: 2026-10-05 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

AT: None

VC: High

VI: None

VA: None

Description

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

CISA Known Exploited Vulnerability

Vendor / Product Atlassian — Multiple Products

Date Added 2026-10-15

Remediation Due 2026-10-18

https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589

Weakness Classification (1)

CWE-552

Affected Software (29)

Vendor	Product	Version
Atlassian	Bamboo Data Center	All other versions
Atlassian	Bitbucket Data Center	All other versions
Atlassian	Confluence Data Center	All other versions
Atlassian	Crowd Data Center	All other versions
Atlassian	Crucible Data Center	All other versions
Atlassian	Fisheye Data Center	All other versions
Atlassian	Jira Service Management Data Center	All other versions
Atlassian	Jira Software Data Center	All other versions
atlassian	bamboo	7.0.1 – 10.2.24
atlassian	bamboo	11.0.0 – 12.1.12
atlassian	bitbucket_data_center	7.17.0 – 9.4.26
atlassian	bitbucket_data_center	9.5.0 – 10.2.8
atlassian	bitbucket_data_center	10.3.0 – 10.5.1
atlassian	bitbucket_server	4.6.0 – 8.14.6
atlassian	confluence_data_center	5.10.0 – 9.2.26
atlassian	confluence_data_center	9.3.0 – 10.2.19
atlassian	crowd	2.11.0 – 6.3.7
atlassian	crowd	7.0.0 – 7.0.3
atlassian	crowd	7.1.0 – 7.1.7
atlassian	crowd	7.2.0 – 7.2.4
atlassian	crucible	< 4.9.15
atlassian	fisheye	< 4.9.15
atlassian	jira_data_center	7.1.0 – 9.12.40
atlassian	jira_data_center	9.13.0 – 10.3.26
atlassian	jira_data_center	10.4.0 – 11.3.12
atlassian	jira_service_desk	3.1.0 – 4.13.27
atlassian	jira_service_management	4.14.0 – 5.12.40
atlassian	jira_service_management	5.13.0 – 10.3.26
atlassian	jira_service_management	10.4.0 – 11.3.12

References & Advisories (10)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589

US Government Resource

https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589

Third Party Advisory

https://jira.atlassian.com/browse/BAM-26567