CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products
Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589 , a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3 . An unauthenticated remote attacker who knows a target file's exact name and path can access it within the application's web root; the vulnerability does not provide directory listing or enumeration. On October 15, CVE-2026-21589 was added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Atlas
- Vendor
- Atlassian
- Product
- Confluence, Jira, Bitbucket
- CVSS v4.0
- 9.3
- EPSS
- 0.99 (p100)
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Collaboration, Developer platform, Identity
Why it ranks 97 (Critical)
- Exploitation observed in the wild
- CVSS v4.0 9.3 critical
- EPSS 0.99 (high probability of exploitation)
- Exposed product class: identity
- Widely deployed vendor product (Atlassian)
- Covered by 10 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Rapid7 research (rapid7.com)
- CVE-2026-21589 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.