AX·NEWS
Sign in

Vulnerability

CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

critical 9.3 Exploited in the wild 6 stories · 4 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • Bitbucket Data Center < 9.4.26 · < 10.2.8 · < 10.5.1
  • and 9 other products

Exposed files · over the network · no login

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.

CISA Known Exploited Vulnerabilities

Added on 2026-10-15, federal remediation due 2026-10-18. Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
    USSecurityWeek Cybersecurity

    Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products. The post Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication appeared first on…

  2. Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
    USSANS ISC Cybersecurity

    On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive…

  3. Hackers exploit critical Atlassian flaw after public PoC release
    USBleepingComputer Cybersecurity

    A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. [...]

  4. Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
    INThe Hacker News Cybersecurity

    Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as…

  5. Atlassian warns of critical file-access flaw in Jira, Confluence
    USBleepingComputer Cybersecurity

    Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]

  6. Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
    INThe Hacker News Cybersecurity

    A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's…