CVE-2026-21589

No known exploitation. EPSS puts it in the 86th percentile. Fixed versions are out.

CVSS —Not scored EPSS percentile86th2.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products12 fixed builds listed below

Published 2026-10-05Updated 2026-10-07Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Atlassian Bamboo Data CenterAffected: All other versionsUpgrade to: not statedFixed buildsPatch version 10.2.24 and later, Patch version 12.1.12 and laterStated by: CVE record
Atlassian Bitbucket Data CenterAffected: All other versionsUpgrade to: not statedFixed buildsPatch version 10.2.8 and later, Patch version 10.5.1 and later, Patch version 9.4.26 and laterStated by: CVE record
Atlassian Confluence Data CenterAffected: All other versionsUpgrade to: not statedFixed buildsPatch version 10.2.19 and later, Patch version 9.2.26 and laterStated by: CVE record
Atlassian Crowd Data CenterAffected: All other versionsUpgrade to: not statedFixed buildsPatch version 7.2.4 and later, Patch version 7.1.7 and later, Patch version 7.0.3 and later, Patch version 6.3.7 and laterStated by: CVE record
Atlassian Crucible Data CenterAffected: All other versionsUpgrade to: not statedFixed buildsPatch version 4.9.15 and laterStated by: CVE record

Versions as the sources state them. 3 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Identify which Atlassian Data Center product(s) and versions you run (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, or Fisheye).
Check if your version falls in the affected range listed by Atlassian for your product.
Upgrade to the fixed patch version for your product — for example Bitbucket Data Center 9.4.26, 10.2.8, or 10.5.1; Confluence Data Center 9.2.26 or 10.2.19; Jira Software/Service Management 9.12.40, 10.3.26, or 11.3.12; Bamboo Data Center 10.2.24 or 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7, or 7.2.4; Crucible/Fisheye 4.9.15.
If you cannot patch immediately, restrict internet access to the application and monitor web server logs for requests to paths like WEB-INF/web.xml.
Confirm with your IT team or vendor that the patch has been applied and verify no suspicious file-access attempts occurred before the fix.

Usually a quick update

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

6 publishers

Attackers began actively targeting a critical pre-auth arbitrary file read vulnerability in Atlassian products within hours of WatchTowr publishing technical details, prompting CISA to advise immediate patching.
as reported · Oct 8, 2026·SecurityWeek summary
Attackers began actively scanning honeypots for the newly patched arbitrary file access vulnerability CVE-2026-21589 affecting multiple Atlassian Data Center products shortly after patches were released.
as reported · Oct 7, 2026·SANS Internet Storm Center summary
Atlassian released patches for CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability affecting eight self-hosted products, with no evidence of active exploitation.
as reported · Oct 7, 2026·SecurityWeek summary
Atlassian issued an advisory urging immediate patching for CVE-2026-21589, a critical arbitrary file access flaw in its self-hosted Data Center products, noting no evidence of current exploitation.
as reported · Oct 6, 2026·BleepingComputer summary
WatchTowr researchers published a technical analysis of CVE-2026-21589, detailing the underlying path traversal mechanism involving double-colon encoding in Atlassian's shared JAR libraries.
as reported · Oct 6, 2026·watchTowr Labs summary

Sourced from public security reporting — each date is when it was published, not when it happened. 4 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

In plain language

Written by AI from the record

Several widely used Atlassian Data Center products (Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye) let an attacker who already knows a file's exact name read it without logging in, and attackers are actively trying this right now — treat it as urgent.

Unauthenticated path-based arbitrary file disclosure (CWE-552) in multiple Atlassian Data Center products allows retrieval of known files (e.g., WEB-INF/web.xml) within the webapp root without directory listing, with active exploitation attempts observed in the wild since October 6, 2026.

If you're affected

Exposure of configuration/credential files
Customer and internal data exposure
Compliance/regulatory exposure
Foothold for further attacks

What is it

Think of this like a building where someone who already knows the exact label on a filing cabinet drawer can open it without a key — they can't browse all the drawers, but if they know a drawer's name, they can pull it open and read what's inside. In this case, the 'drawers' are configuration and system files inside these Atlassian products, and attackers don't need a login to open them.

Who is affected

This matters to you if you run Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, or Jira Software Data Center. It is a risk by default whenever the application is reachable from the internet — no special feature needs to be enabled.

How urgent is it

Attackers are already actively scanning for and attempting to exploit this vulnerability, with confirmed in-the-wild attempts detected on honeypot networks starting October 6, 2026, just after technical details were published. This is not a theoretical risk — it is being exploited now, so action should be taken immediately rather than scheduled for a future maintenance window.

What to do — in detail

Confirm exposure by checking whether your Data Center instances are internet-reachable and by reviewing access logs for unusual GET requests to known sensitive paths (e.g., WEB-INF/web.xml, configuration files). Determine your exact product and version against Atlassian's affected ranges (e.g., Bitbucket >=4.6.0, Confluence >=5.10.0, Crowd >=2.11.0, Jira Software >=7.1.0, Jira Service Management >=3.1.0, Bamboo >=7.0.1). Upgrade to the fixed version for your branch: Bitbucket 9.4.26/10.2.8/10.5.1; Confluence 9.2.26/10.2.19; Jira Software & Jira Service Management 9.12.40/10.3.26/11.3.12; Bamboo 10.2.24/12.1.12; Crowd 6.3.7/7.0.3/7.1.7/7.2.4; Crucible and Fisheye 4.9.15. Review Atlassian's upgrade notes for breaking changes between major branches before upgrading. As a temporary mitigation if patching is delayed, restrict network access to these applications (VPN/allow-list only) and deploy a WAF rule blocking requests for known sensitive file paths. No CISA KEV listing exists yet, but given confirmed active exploitation, prioritize this above routine patch cycles. Monitor logs for repeated requests to WEB-INF/ or other config paths as an indicator of attempted exploitation.

Technical context

CWE-552 (Files or Directories Accessible to External Parties) enabling unauthenticated arbitrary file read via network, requiring no user interaction and reachable by default; exploitation requires prior knowledge of exact file path (no directory enumeration). Not currently listed in CISA KEV. Exploit maturity is limited to a detection/PoC template plus confirmed in-the-wild scanning and file-read attempts observed on honeypots since 2026-10-06 following watchTowr's technical writeup, targeting files such as WEB-INF/web.xml. Given confirmed active exploitation, EPSS scoring is not the relevant signal here — treat as actively exploited.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.