Atlassian Arbitrary File Access Vulnerability
CVE-2026-21589 is a critical arbitrary file access vulnerability affecting multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability allows an unauthenticated remote attacker to access specific files within an affected application's web root directory. Exploitation requires the attacker to know the exact name and path of the target file in advance. The vulnerability does not provide directory listing or file enumeration capabilities by itself. Depending on the files exposed and the application configuration, successful exploitation could disclose sensitive information and potential
Read at FortiGuard Outbreak Alerts
- Vendor
- Atlassian
- Product
- Confluence, Jira, Bitbucket
- EPSS
- 0.99 (p100)
- Exposure class
- Collaboration, Developer platform
Why it ranks 46 (High)
- EPSS 0.99 (high probability of exploitation)
- Product class: collaboration, developer platform
- Widely deployed vendor product (Atlassian)
- Covered by 10 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- FortiGuard Outbreak Alerts (fortiguard.fortinet.com)
- CVE-2026-21589 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.