CVE-2026-21589
published 2026-10-05CVE-2026-21589: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center…
PriorityP187high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-10-18
Exploited in the wild
EPSS
12.71%
96.3th percentile
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | bamboo | >= 11.0.0 < 12.1.12 | 12.1.12 |
| atlassian | bamboo | >= 7.0.1 < 10.2.24 | 10.2.24 |
| atlassian | bamboo_data_center | — | — |
| atlassian | bitbucket_data_center | — | — |
| atlassian | bitbucket_data_center | >= 10.3.0 < 10.5.1 | 10.5.1 |
| atlassian | bitbucket_data_center | >= 7.17.0 < 9.4.26 | 9.4.26 |
| atlassian | bitbucket_data_center | >= 9.5.0 < 10.2.8 | 10.2.8 |
| atlassian | bitbucket_server | 4.6.0 – 8.14.6 | — |
| atlassian | confluence_data_center | — | — |
| atlassian | confluence_data_center | >= 5.10.0 < 9.2.26 | 9.2.26 |
| atlassian | confluence_data_center | >= 9.3.0 < 10.2.19 | 10.2.19 |
| atlassian | crowd | >= 2.11.0 < 6.3.7 | 6.3.7 |
| atlassian | crowd | >= 7.0.0 < 7.0.3 | 7.0.3 |
| atlassian | crowd | >= 7.1.0 < 7.1.7 | 7.1.7 |
| atlassian | crowd | >= 7.2.0 < 7.2.4 | 7.2.4 |
| atlassian | crowd_data_center | — | — |
| atlassian | crucible | < 4.9.15 | 4.9.15 |
| atlassian | crucible_data_center | — | — |
| atlassian | fisheye | < 4.9.15 | 4.9.15 |
| atlassian | fisheye_data_center | — | — |
| atlassian | jira_data_center | >= 10.4.0 < 11.3.12 | 11.3.12 |
| atlassian | jira_data_center | >= 7.1.0 < 9.12.40 | 9.12.40 |
| atlassian | jira_data_center | >= 9.13.0 < 10.3.26 | 10.3.26 |
| atlassian | jira_service_desk | 3.1.0 – 4.13.27 | — |
| atlassian | jira_service_management | >= 10.4.0 < 11.3.12 | 11.3.12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gr66-x5pq-8g2g: h3
ghsa_unreviewed·2026-10-06
CVE-2026-21589 [CRITICAL] GHSA-gr66-x5pq-8g2g: h3
h3. Summary
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe.
h3. Context
This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions.
h3. D
VulDB
Atlassian Bamboo Data Center path traversal
vuldb·2026-10-05·CVSS 9.3
CVE-2026-21589 [CRITICAL] Atlassian Bamboo Data Center path traversal
A vulnerability, which was classified as problematic, was found in Atlassian Bamboo Data Center, Bamboo Server, Bitbucket Data Center, Bitbucket Server, Confluence Data Center, Confluence Server, Crowd Data Center, Crowd Server, Crucible Data Center, Crucible Server, Fisheye Data Center, Fisheye Server, Jira Service Management Data Center, Jira Service Management Server, Jira Software Data Center and Jira Software Server. This affects an unknown function. Such manipulation leads to path traversal.
This vulnerability is listed as CVE-2026-21589. The attack may be performed from remote. There is no available exploit.
VulnCheck
Atlassian bamboo_data_center Files or Directories Accessible to External Parties
vulncheck·2026·CVSS 9.3
CVE-2026-21589 [CRITICAL] Atlassian bamboo_data_center Files or Directories Accessible to External Parties
Atlassian bamboo_data_center Files or Directories Accessible to External Parties
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web
CISA
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
cisa·2026-10-15·CVSS 7.5
CVE-2026-21589 [HIGH] CWE-552 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Vulnerability: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Affected: Atlassian Multiple Products
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see UR
No detection rules found.
Nuclei
Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read
nuclei·CVSS 7.5
CVE-2026-21589 [HIGH] Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read
Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read
Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.
Template:
id: CVE-2026-21589
info:
name: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read
author: Kazgangap,DhiyaneshDk,watchtowr
severity: critical
description: |
Atlassian products includ
Checkpoint
12th October – Threat Intelligence Report
blogs_checkpoint·2026-10-12
CVE-2025-64393 12th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 12th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier. The incident reportedly exposed personal information, including names, addresses, and identification numbers, associated with approximately 8.8 million individuals in the natio
Hackernews
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
blogs_hackernews·2026-10-12·CVSS 9.3
CVE-2026-21589 [CRITICAL] ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it.
But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. Malware got better at hiding its tracks. And some systems turned out to be easier to break into than anyone would like to admit. The odd par
Sans Isc
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
blogs_sans_isc·2026-10-07·CVSS 9.3
CVE-2026-21589 [CRITICAL] Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
Scans for Atlassian vulnerablity (CVE-2026-21589)
Published: 2026-10-07. Last Updated: 2026-10-07 14:59:33 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)
On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.
This directory traversal vulnerability is a little bit different from the textbook case. Atlassian products replace slashes with the pattern "::". To avoid this issue, but may, in some cases, undo this escape to access files. Watchtowr has a great write-up with all the details and proof-of-concept URLs demonstrating the vulnerability [Watchtowr].
Starting yes
Hackernews
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
blogs_hackernews·2026-10-07·CVSS 9.3
CVE-2026-21589 [CRITICAL] Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.
The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.
"This arbitrary file access vulnerability allows an unauthenticated
Rapid7
CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products
blogs_rapid7·2026-10-07·CVSS 9.3
CVE-2026-21589 [CRITICAL] CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products
## Overview
On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589 , a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3 . An unauthenticated remote attacker who knows a target file's exact name and path can access it within the application's web root; the vulnerability does not provide directory listing or enumeration.
Atlassian's advisory treats all versions before the applicable fixed releases as affected, including unsupported versions. Affected Atlassian Cloud products have already been patched, and no action i
Hackernews
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
blogs_hackernews·2026-10-06·CVSS 9.3
CVE-2026-21589 [CRITICAL] Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory.
The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw , CVE-2026-21589 , on October 5, rated it 9.3 out of 10, and listed a fixed version for each product.
The web application root directory is the folder on the server that holds the web application itself. In some
https://jira.atlassian.com/browse/BAM-26567https://jira.atlassian.com/browse/BSERV-20604https://jira.atlassian.com/browse/CONFSERVER-104488https://jira.atlassian.com/browse/CRUC-8741https://jira.atlassian.com/browse/CWD-6610https://jira.atlassian.com/browse/FE-7583https://jira.atlassian.com/browse/JRASERVER-79546https://jira.atlassian.com/browse/JSDSERVER-16809https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589
2026-10-05
Published
2026-10-15
Added to CISA KEV
Exploited in the wild