Atlassian · Exploitation confirmed

CISA confirms active exploitation of CVE-2026-21589 in Atlassian Data Center

Oct 14, 2026 · 1 min read

CVE-2026-21589 allows an unauthenticated attacker to read files from the application root directory in eight Atlassian Data Center products, including Confluence, Jira and Bitbucket. CISA added the flaw to its KEV catalog, indicating active exploitation, and watchTowr published technical details. Atlassian released fixed versions on 05 Oct 2026 and urges immediate patching or restricted internet access.

By HIFY Radar newsroom Updated 10/27/2026 07:07 AM Get this every day →← Back to the feed 3 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A critical flaw in eight Atlassian Data Center products, including Confluence, Jira and Bitbucket, lets attackers read files from the server without credentials or login. CISA, the US cybersecurity agency, added the flaw to its Known Exploited Vulnerabilities catalog, confirming active exploitation. Fixes have been available since 05 Oct 2026.

Why it matters

Attackers can read sensitive files in the application directory, depending on each deployment's configuration. Companies running self-hosted Confluence, Jira, Jira Service Management, Bitbucket, Bamboo, Crowd, Crucible or Fisheye exposed to the internet are at risk. Atlassian rates the risk as Critical, scoring 9.3.

What to do

Patch every Data Center installation to the fixed versions Atlassian listed. Until then, remove instances from the internet or apply the web application firewall rule Atlassian published. Atlassian Cloud environments are already patched and require no action.

For the technical team

CVE: CVE-2026-21589
Affected: Atlassian, múltiplos produtos · Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. All versions prior to the fixed ones are affected. Atlassian Cloud products are already patched and require no customer action.
Exploitation: CISA added CVE-2026-21589 to the KEV catalog, indicating active exploitation in the wild. watchTowr published technical details describing the flaw as a pre-auth arbitrary file read. Atlassian states it found no evidence of exploitation in Cloud products.
Fix: Fixed versions per product: Bitbucket 9.4.26, 10.2.8, 10.5.1; Confluence 9.2.26, 10.2.19; Jira Service Management 5.12.40, 10.3.26, 11.3.12; Jira Software 9.12.40, 10.3.26, 11.3.12; Bamboo 10.2.24, 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4; Crucible 4.9.15; Fisheye 4.9.15 (all Data Center). Temporary mitigations: restrict external access to the instance, a WAF rule with regex blocking '..' adjacent to '/', '\' or '::' (including URL-encoded variants), or Tomcat's RewriteValve for Confluence, JSM, Jira, Bamboo and Crowd.
Vector: Unauthenticated (pre-auth) arbitrary file read in Atlassian Data Center products. The attacker accesses files within the web application root directory and must know the target file's exact name and path in advance; the flaw does not allow enumerating or listing directory contents. Atlassian CVSS:4.0 vector: 9.3, network, low complexity, no privileges (AV:N/AC:L/PR:N). Instances accessible to the public internet, including those with user authentication, should be treated as exposed.
More details: Atlassian advisory released 05 Oct 2026. NVD lists reference severity high and start date 2026-10-15. Atlassian internal tickets: BSERV-20604, CONFSERVER-104488, JSDSERVER-16809, JRASERVER-79546, BAM-26567, CWD-6610, CRUC-8741, FE-7583. Atlassian warns some configurations may contain sensitive files in the root directory, increasing risk.

Timeline

10/27/2026 07:07 AM
watchTowr team publishes technical details: the flaw is a pre-auth arbitrary file read.
10/26/2026 01:29 PM
CISA KEV listing indicates active exploitation of the flaw.