CVE-2026-21589: Atlassian Products Expose Files to Unauthenticated Attackers

## Overview CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalog on October 15, 2026. This vulnerability affects multiple Atlassian products, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye. The addition to the KEV list indicates a federal deadline for remediation due to evidence of exploitation. ## Technical Details CVE-2026-21589 is an Arbitrary File Access vulnerability. It allows unauthenticated attackers to access specific files within the web application root directory. Exploitation requires knowledge of the exact file name and path. The vulnerability does not permit directory enumeration, but it can expose sensitive files in certain configurations. Affected versions include: - Bitbucket Data Center (>= 4.6.0) - Confluence Data Center (>= 5.10.0) - Crowd Data Center (>= 2.11.0) - Jira Software Data Center (>= 7.1.0) - Jira Service Management Data Center (>= 3.1.0) - Bamboo Data Center (>= 7.0.1) - Crucible (specific versions) - Fisheye (specific versions) ## Impact The vulnerability's severity is rated at CVSS 9.3. Successful exploitation could lead to unauthorized access to sensitive information stored within the affected applications. This poses a significant risk to organizations relying on these Atlassian products. ## Mitigation Organizations should immediately update to the fixed versions of the affected products. The following versions address the vulnerability: - Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1 - Confluence Data Center: 9.2.26, 10.2.19 - Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4 - Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12 - Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12 - Bamboo Data Center: 10.2.24, 12.1.12 - Crucible: 4.9.15 - Fisheye: 4.9.15 Failure to remediate this vulnerability could expose organizations to significant risks.