CVE-2026-21589: Atlassian Data Center File Access (KEV)
CVE-2026-21589 is an arbitrary file access vulnerability in Atlassian's shared web-resource component that lets an unauthenticated attacker who already knows a target file's exact name and path read that file from the web application root of eight self-managed Data Center products, including Confluence, Jira and Bitbucket; CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-15 after confirming in-the-wild exploitation.
Vulnerability summary
| Vulnerability ID | CVE-2026-21589 |
|---|---|
| CVSS score | 7.5 |
| EPSS score | 0.1271 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-10-05T22:16:58.423 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Atlassian Confluence Data Center | cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* | 5.10.0 through 9.2.25 (fixed in 9.2.26); 9.3.0 through 10.2.18 (fixed in 10.2.19) |
| Atlassian Bitbucket Data Center / Bitbucket Server | cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:* | Data Center: 7.17.0 through 9.4.25 (fixed in 9.4.26); 9.5.0 through 10.2.7 (fixed in 10.2.8); 10.3.0 through 10.5.0 (fixed in 10.5.1). Bitbucket Server 4.6.0 through 8.14.6 is also affected with no fixed version listed (past end of life) |
| Other Atlassian Data Center products (Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye) | — | All versions before: Jira Software 9.12.40/10.3.26/11.3.12; Jira Service Management 5.12.40/10.3.26/11.3.12; Bamboo 10.2.24/12.1.12; Crowd 6.3.7/7.0.3/7.1.7/7.2.4; Crucible and Fisheye 4.9.15 |
What this means
CVE-2026-21589 is a files-or-directories-accessible-to-external-parties flaw (CWE-552) traced to version differences in Atlassian's shared atlassian-plugins-webresource component. Atlassian's advisory states the bug "allows an unauthenticated attacker to access specific files within the web application root directory in affected versions," but "exploitation requires prior knowledge of the target file's exact name and path" and "does not allow attackers to enumerate or list directory contents" (Atlassian Security Advisory).
NVD's own analysis scores it CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; Atlassian's own CNA submission separately scores it CVSS v4.0 9.3 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H (NVD).
Atlassian's advisory, published 2026-10-05, lists the fixed versions above for Confluence, Bitbucket, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center, notes Atlassian Cloud was already patched with no customer action required, and offers temporary mitigations (WAF regex filtering, a Tomcat RewriteValve rule, or a Bitbucket urlrewrite.xml change) for instances that cannot patch immediately (Atlassian Security Advisory).
CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-15, with a required-action due date of 2026-10-18, confirming active exploitation of self-managed Data Center instances (CISA KEV).
As of 2026-10-21, FIRST scores the probability of exploitation at 0.1271 (96.3th percentile) (FIRST EPSS).
Because this is a KEV-listed, actively exploited flaw across eight widely deployed collaboration and DevOps tools, self-managed Data Center and Server administrators should patch to the fixed versions immediately, or apply Atlassian's interim WAF/rewrite mitigations where patching must wait, and review access logs for requests to known sensitive file paths.
Evidence
- Unauthenticated arbitrary file access (CWE-552) in Atlassian's shared web-resource handling lets an attacker who knows a file's exact name/path read it from the web app root; no directory enumeration. — Atlassian Security Advisory
- NVD's own CVSS v3.1 base score is 7.5 (high), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; Atlassian's own CNA submission separately scores CVSS v4.0 9.3. — NVD
- Affects Confluence, Bitbucket, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center at the listed versions and below; Cloud already patched; interim WAF/rewrite mitigations available. — Atlassian Security Advisory
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-15, required action due 2026-10-18. — CISA KEV
- EPSS score is 0.1271 (96.3th percentile) as of 2026-10-21. — FIRST EPSS