CISA Adds Atlassian File Access Flaw CVE-2026-21589 to Known Exploited Vulnerabilities Catalog
The US cybersecurity agency lists an unauthenticated arbitrary file access bug in multiple Atlassian Data Center products, setting a strict patch deadline.
Key points
- CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog on October 15, 2026.
- The flaw allows unauthenticated attackers to read specific files in the web root of affected Atlassian products.
- A federal due date for remediation is set for October 18, 2026, under Binding Operational Directive 26-04.
The Cybersecurity and Infrastructure Security Agency added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on October 15, 2026. This entry mandates that federal agencies address the vulnerability by October 18, 2026, to comply with Binding Operational Directive 26-04.
At a glance
- CVE
- CVE-2026-21589
- Vendor
- Atlassian
- Product
- Multiple Products
- CVSS
- 9.3 CRITICAL
- Weakness
- files or directories accessible to external parties
- Exploited
- Yes (CISA KEV)
- Ransomware use
- Unknown
- Patch deadline (FCEB)
- October 18, 2026
The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.3. According to the NVD record, the vulnerability is an arbitrary file access issue classified under CWE-552. It affects multiple Atlassian Data Center products, allowing unauthenticated remote attackers to access specific files within the web application root directory.
Context and Background
Exploitation of this vulnerability requires prior knowledge of the target file's exact name and path. The NVD notes that attackers cannot enumerate or list directory contents through this flaw. However, the presence of sensitive files in some configurations makes the severity highly critical. The CISA entry states that ransomware use is currently unknown.
CISA requires stakeholders to apply mitigations in accordance with vendor instructions. The agency emphasizes compliance with BOD 26-04 guidance for prioritizing security updates based on risk. If mitigations are unavailable, the directive instructs stakeholders to discontinue use of the product or follow cloud service guidance.
Who Is Affected
The vulnerability impacts Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian has released fix versions for all affected products.
For Bitbucket Data Center, fixes are available in versions 9.4.26, 10.2.8, and 10.5.1. Confluence Data Center users should update to versions 9.2.26 or 10.2.19. Crowd Data Center requires updates to versions 6.3.7, 7.0.3, 7.1.7, or 7.2.4.
Jira Software Data Center and Jira Service Management Data Center share fix versions 9.12.40, 10.3.26, and 11.3.12. Bamboo Data Center fixes are available in versions 10.2.24 and 12.1.12. Crucible and Fisheye users must update to version 4.9.15.
What should you do?
Organizations should immediately inventory their Atlassian Data Center installations to determine if they run vulnerable versions. Administrators must verify whether they can access the specific fix versions listed by Atlassian. If updates are not possible, stakeholders must evaluate internet exposure and consider discontinuing use per CISA guidance.
What to do and how to stay safe: Atlassian
- Audit all Atlassian Data Center products to identify if they run versions prior to the listed fix releases.
- Apply the vendor-provided updates for Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye as soon as possible.
- Restrict external access to affected web application root directories to limit the impact of unauthenticated file access.
- Monitor logs for unusual file access attempts that could indicate an attacker guessing specific file paths.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can attackers list directory contents using CVE-2026-21589?
No, the vulnerability does not allow attackers to enumerate or list directory contents; they must know the exact file name and path.
What is the federal deadline for patching this vulnerability?
The federal due date for remediation is October 18, 2026, according to the CISA KEV catalog entry.
Which Atlassian products are affected by this flaw?
Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center versions.
