Search/CVE-2026-21589
● CVE

CVE-2026-21589

DiscoveredOct 5, 2026UpdatedOct 7, 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be…

CVSS v3.1
—
EPSS
12.7%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
10
sources referencing this CVE
Related IOCs
seen in the same coverage
EPSS Trend
Oct 7, 2026 → Oct 22, 2026
▲ 12.0pp
0.74% → 12.7% over 2 tracked changes
Connections
12 relationships
Timeline
disclosure → media coverage
Oct 5, 2026
Disclosure — published as a CVE record.
Oct 6, 2026
theregister.com reports: Atlassian warns of critical file access flaw in its datacenter products
Oct 6, 2026
thehackernews.com reports: Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
Oct 6, 2026
helpnetsecurity.com reports: Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)
Oct 6, 2026
bleepingcomputer.com reports: Atlassian warns of critical file-access flaw in Jira, Confluence
Oct 7, 2026
securityweek.com reports: Atlassian Patches Critical Vulnerability Affecting 8 Products
Oct 7, 2026
cert.europa.eu reports: 2026-015: Critical Vulnerability in Multiple Atlassian Products
Oct 7, 2026
thehackernews.com reports: Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Oct 7, 2026
bleepingcomputer.com reports: Hackers exploit critical Atlassian flaw after public PoC release
Oct 7, 2026
helpnetsecurity.com reports: Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)
Oct 7, 2026
isc.sans.edu reports: Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)