CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-10-15
EPSS: 99.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-05 · updated 2026-10-29
Weakness: CWE-552

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Summary

CVE-2026-21589 is an arbitrary file access vulnerability in multiple Atlassian Data Center products (Bitbucket, Confluence, Jira Software, Jira Service Management, Crowd, Bamboo, Crucible, and Fisheye). An unauthenticated remote attacker can read specific files within the web application root directory if they know the exact file name and path; directory listing is not possible. Some configurations may expose sensitive files, making impact high (CVSS 7.5). The flaw is listed in CISA KEV with active exploitation, a public exploit exists, and EPSS is 99.5%. Affected versions include Bitbucket >=4.6.0 (fix 9.4.26, 10.2.8, 10.5.1), Confluence >=5.10.0 (fix 9.2.26, 10.2.19), Crowd >=2.11.0 (fix 6.3.7, 7.0.3, 7.1.7, 7.2.4), Jira Software >=7.1.0 (fix 9.12.40, 10.3.26, 11.3.12), Jira Service Management >=3.1.0 (fix 5.12.40, 10.3.26, 11.3.12), Bamboo >=7.0.1 (fix 10.2.24, 12.1.12), Crucible (fix 4.9.15), and Fisheye (fix 4.9.15). Apply the fixed versions immediately and follow CISA BOD 26-04 guidance, including evaluating internet exposure and discontinuing use if mitigations are unavailable.

CVE-2026-21589 هو ثغرة وصول عشوائي إلى الملفات في منتجات Atlassian Data Center المتعددة (Bitbucket وConfluence وJira Software وJira Service Management وCrowd وBamboo وCrucible وFisheye). يمكن لمهاجم عن بُعد غير مصادق عليه قراءة ملفات محددة داخل الدليل الجذر لتطبيق الويب إذا كان يعرف اسم الملف ومساره بدقة؛ ولا يمكنه تعداد محتويات الدليل. قد تؤدي بعض التكوينات إلى كشف ملفات حساسة، مما يجعل التأثير عاليًا (CVSS 7.5). الثغرة مدرجة في CISA KEV مع استغلال نشط، ويوجد استغلال عام، واحتمال EPSS هو 99.5%. تشمل الإصدارات المتأثرة Bitbucket >=4.6.0 (الإصلاح 9.4.26، 10.2.8، 10.5.1)، Confluence >=5.10.0 (الإصلاح 9.2.26، 10.2.19)، Crowd >=2.11.0 (الإصلاح 6.3.7، 7.0.3، 7.1.7، 7.2.4)، Jira Software >=7.1.0 (الإصلاح 9.12.40، 10.3.26، 11.3.12)، Jira Service Management >=3.1.0 (الإصلاح 5.12.40، 10.3.26، 11.3.12)، Bamboo >=7.0.1 (الإصلاح 10.2.24، 12.1.12)، Crucible (الإصلاح 4.9.15)، وFisheye (الإصلاح 4.9.15). طبّق الإصدارات المُصلحة فورًا واتبع إرشادات CISA BOD 26-04، بما في ذلك تقييم التعرض للإنترنت والتوقف عن الاستخدام إذا لم تتوفر معالجات.

Affected products

Atlassian Bamboo: from 7.0.1 before 10.2.24; from 11.0.0 before 12.1.12 — fixed in 10.2.24, 12.1.12
Atlassian Bitbucket Data Center: from 7.17.0 before 9.4.26; from 9.5.0 before 10.2.8; from 10.3.0 before 10.5.1 — fixed in 9.4.26, 10.2.8, 10.5.1
Atlassian Bitbucket Server: from 4.6.0 through 8.14.6
Atlassian Confluence Data Center: from 5.10.0 before 9.2.26; from 9.3.0 before 10.2.19 — fixed in 9.2.26, 10.2.19
Atlassian Crowd: from 2.11.0 before 6.3.7; from 7.0.0 before 7.0.3; from 7.1.0 before 7.1.7; from 7.2.0 before 7.2.4 — fixed in 6.3.7, 7.0.3, 7.1.7, 7.2.4
Atlassian Crucible: before 4.9.15 — fixed in 4.9.15
Atlassian Fisheye: before 4.9.15 — fixed in 4.9.15
Atlassian Jira: from 7.1.0 before 9.12.40; from 9.13.0 before 10.3.26; from 10.4.0 before 11.3.12 — fixed in 9.12.40, 10.3.26, 11.3.12
Atlassian Jira Service Desk Server: from 3.1.0 through 4.13.27
Atlassian Jira Service Management: from 4.14.0 before 5.12.40; from 5.13.0 before 10.3.26; from 10.4.0 before 11.3.12 — fixed in 5.12.40, 10.3.26, 11.3.12
Atlassian Bamboo: All other versions
Atlassian Bitbucket Data Center: All other versions
Atlassian Confluence Data Center: All other versions
Atlassian Crowd: All other versions
Atlassian Crucible Data Center: All other versions
Atlassian Fisheye Data Center: All other versions
Atlassian Jira Service Management Data Center: All other versions
Atlassian Jira Software Data Center: All other versions

How to fix

Upgrade to a fixed version: Atlassian Bamboo 10.2.24, 12.1.12; Atlassian Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1; Atlassian Confluence Data Center 9.2.26, 10.2.19; Atlassian Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4; Atlassian Crucible 4.9.15; Atlassian Fisheye 4.9.15; Atlassian Jira 9.12.40, 10.3.26, 11.3.12; Atlassian Jira Service Management 5.12.40, 10.3.26, 11.3.12. Check the vendor advisory for mitigations.

In the news

References

Get alerted when CVE-2026-21589 or the next vulnerability affects your stack