CVE-2026-21589 | defend.network

What is CVE-2026-21589?

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

CVSS9.3 NVD 4.0

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS1% · P53

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWECWE-552

NVD published2026-10-05

NVD last modified2026-10-06

Timeline

2026-10-05Published to the U.S. National Vulnerability Database (NVD)
2026-10-06NVD record last updated
2026-10-07First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Identify all self-hosted Atlassian Data Center instances in your environment
Apply the security patch provided by Atlassian for your affected product versions
Verify that unauthenticated file-access attempts are blocked post-patch
Review access logs for signs of file-access exploitation prior to patching

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 1 of October 2026 (October 5 – 11)
WordPress, Atlassian, ASOS breached; AI-powered phishing escalates (2026-10-07)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.