{"cve":{"cve_id":"CVE-2026-21589","is_kev":true,"kev_date_added":"2026-10-15","kev_vendor_project":"Atlassian","kev_product":"Multiple Products","kev_vulnerability_name":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","kev_short_description":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","kev_required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","kev_due_date":"2026-10-18","kev_known_ransomware":false,"kev_notes":"https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589","kev_cwes":["CWE-552"],"epss_score":0.02777,"epss_percentile":0.86118,"epss_as_of":"2026-10-15","description":"This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.","published_at":"2026-10-05T21:30:00.390000Z","last_modified_at":"2026-10-19T20:31:57.050000Z","cvss_v3_score":7.5,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_v3_severity":"HIGH","cvss_v4_score":9.3,"cvss_v4_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","cvss_v4_severity":"CRITICAL","ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":["CWE-552"],"nvd_references":["https://jira.atlassian.com/browse/BAM-26567","https://jira.atlassian.com/browse/BSERV-20604","https://jira.atlassian.com/browse/CONFSERVER-104488","https://jira.atlassian.com/browse/CRUC-8741","https://jira.atlassian.com/browse/CWD-6610","https://jira.atlassian.com/browse/FE-7583","https://jira.atlassian.com/browse/JRASERVER-79546","https://jira.atlassian.com/browse/JSDSERVER-16809"],"vuln_status":"Analyzed","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-10-05T22:34:34.423313Z","updated_at":"2026-10-23T01:25:46.062851Z"},"effective_severity":"CRITICAL","badges":["kev","poc","news"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"N","value_label":"None"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":"4.0","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"AT","name":"Attack Requirements","value":"N","value_label":"None"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"VC","name":"Confidentiality (Vulnerable System)","value":"H","value_label":"High"},{"metric":"VI","name":"Integrity (Vulnerable System)","value":"N","value_label":"None"},{"metric":"VA","name":"Availability (Vulnerable System)","value":"N","value_label":"None"},{"metric":"SC","name":"Confidentiality (Subsequent System)","value":"H","value_label":"High"},{"metric":"SI","name":"Integrity (Subsequent System)","value":"H","value_label":"High"},{"metric":"SA","name":"Availability (Subsequent System)","value":"H","value_label":"High"}]},"affected":[{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bamboo","product_name":"Bamboo","version_start":"7.0.1","version_start_inclusive":true,"version_end":"10.2.24","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bamboo-data-center","product_name":"Bamboo Data Center","version_start":"Patch version 10.2.24 and later","version_start_inclusive":true,"version_end":"Patch version 10.2.24 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bamboo-data-center:Patch version 10.2.24 and later:Patch version 10.2.24 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bamboo-data-center","product_name":"Bamboo Data Center","version_start":"Patch version 10.2.4 and later","version_start_inclusive":true,"version_end":"Patch version 10.2.4 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bamboo-data-center:Patch version 10.2.4 and later:Patch version 10.2.4 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bamboo-data-center","product_name":"Bamboo Data Center","version_start":"Patch version 12.1.12 and later","version_start_inclusive":true,"version_end":"Patch version 12.1.12 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bamboo-data-center:Patch version 12.1.12 and later:Patch version 12.1.12 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bamboo-data-center","product_name":"Bamboo Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bamboo-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bamboo-server","product_name":"Bamboo Server","version_start":"All versions","version_start_inclusive":true,"version_end":"All versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bamboo-server:All versions:All versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bitbucket-data-center","product_name":"Bitbucket Data Center","version_start":"7.17.0","version_start_inclusive":true,"version_end":"9.4.26","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bitbucket-data-center","product_name":"Bitbucket Data Center","version_start":"Patch version 10.5.1 and later","version_start_inclusive":true,"version_end":"Patch version 10.5.1 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bitbucket-data-center:Patch version 10.5.1 and later:Patch version 10.5.1 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bitbucket-data-center","product_name":"Bitbucket Data Center","version_start":"Patch version 9.4.26 and later","version_start_inclusive":true,"version_end":"Patch version 9.4.26 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bitbucket-data-center:Patch version 9.4.26 and later:Patch version 9.4.26 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bitbucket-data-center","product_name":"Bitbucket Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bitbucket-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bitbucket-data-center","product_name":"Bitbucket Data Center","version_start":"Patch version 10.2.8 and later","version_start_inclusive":true,"version_end":"Patch version 10.2.8 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bitbucket-data-center:Patch version 10.2.8 and later:Patch version 10.2.8 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bitbucket-server","product_name":"Bitbucket Server","version_start":"All versions","version_start_inclusive":true,"version_end":"All versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:bitbucket-server:All versions:All versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"bitbucket-server","product_name":"Bitbucket Server","version_start":"4.6.0","version_start_inclusive":true,"version_end":"8.14.6","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"confluence-data-center","product_name":"Confluence Data Center","version_start":"Patch version 10.2.19 and later","version_start_inclusive":true,"version_end":"Patch version 10.2.19 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:confluence-data-center:Patch version 10.2.19 and later:Patch version 10.2.19 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"confluence-data-center","product_name":"Confluence Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:confluence-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"confluence-data-center","product_name":"Confluence Data Center","version_start":"Patch version 9.2.26 and later","version_start_inclusive":true,"version_end":"Patch version 9.2.26 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:confluence-data-center:Patch version 9.2.26 and later:Patch version 9.2.26 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"confluence-data-center","product_name":"Confluence Data Center","version_start":"5.10.0","version_start_inclusive":true,"version_end":"9.2.26","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"confluence-server","product_name":"Confluence Server","version_start":"All versions","version_start_inclusive":true,"version_end":"All versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:confluence-server:All versions:All versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd","product_name":"Crowd","version_start":"2.11.0","version_start_inclusive":true,"version_end":"6.3.7","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd-data-center","product_name":"Crowd Data Center","version_start":"Patch version 7.1.7 and later","version_start_inclusive":true,"version_end":"Patch version 7.1.7 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crowd-data-center:Patch version 7.1.7 and later:Patch version 7.1.7 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd-data-center","product_name":"Crowd Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crowd-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd-data-center","product_name":"Crowd Data Center","version_start":"Patch version 7.2.4 and later","version_start_inclusive":true,"version_end":"Patch version 7.2.4 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crowd-data-center:Patch version 7.2.4 and later:Patch version 7.2.4 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd-data-center","product_name":"Crowd Data Center","version_start":"Patch version 7.1.1 and later","version_start_inclusive":true,"version_end":"Patch version 7.1.1 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crowd-data-center:Patch version 7.1.1 and later:Patch version 7.1.1 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd-data-center","product_name":"Crowd Data Center","version_start":"Patch version 7.0.3 and later","version_start_inclusive":true,"version_end":"Patch version 7.0.3 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crowd-data-center:Patch version 7.0.3 and later:Patch version 7.0.3 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd-data-center","product_name":"Crowd Data Center","version_start":"Patch version 6.3.7 and later","version_start_inclusive":true,"version_end":"Patch version 6.3.7 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crowd-data-center:Patch version 6.3.7 and later:Patch version 6.3.7 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crowd-server","product_name":"Crowd Server","version_start":"All versions","version_start_inclusive":true,"version_end":"All versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crowd-server:All versions:All versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crucible","product_name":"Crucible","version_start":null,"version_start_inclusive":null,"version_end":"4.9.15","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crucible-data-center","product_name":"Crucible Data Center","version_start":"Patch version 4.9.15 and later","version_start_inclusive":true,"version_end":"Patch version 4.9.15 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crucible-data-center:Patch version 4.9.15 and later:Patch version 4.9.15 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crucible-data-center","product_name":"Crucible Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crucible-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crucible-server","product_name":"Crucible Server","version_start":"Patch version 4.9.15 and later","version_start_inclusive":true,"version_end":"Patch version 4.9.15 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crucible-server:Patch version 4.9.15 and later:Patch version 4.9.15 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"crucible-server","product_name":"Crucible Server","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:crucible-server:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"fisheye","product_name":"Fisheye","version_start":null,"version_start_inclusive":null,"version_end":"4.9.15","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"fisheye-data-center","product_name":"Fisheye Data Center","version_start":"Patch version 4.9.15 and later","version_start_inclusive":true,"version_end":"Patch version 4.9.15 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:fisheye-data-center:Patch version 4.9.15 and later:Patch version 4.9.15 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"fisheye-data-center","product_name":"Fisheye Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:fisheye-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"fisheye-server","product_name":"Fisheye Server","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:fisheye-server:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"fisheye-server","product_name":"Fisheye Server","version_start":"Patch version 4.9.15 and later","version_start_inclusive":true,"version_end":"Patch version 4.9.15 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:fisheye-server:Patch version 4.9.15 and later:Patch version 4.9.15 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-data-center","product_name":"Jira Data Center","version_start":"7.1.0","version_start_inclusive":true,"version_end":"9.12.40","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-desk","product_name":"jira_service_desk","version_start":"3.1.0","version_start_inclusive":true,"version_end":"4.13.27","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-management","product_name":"jira_service_management","version_start":"4.14.0","version_start_inclusive":true,"version_end":"5.12.40","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-management-data-center","product_name":"Jira Service Management Data Center","version_start":"Patch version 10.3.26 and later","version_start_inclusive":true,"version_end":"Patch version 10.3.26 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-service-management-data-center:Patch version 10.3.26 and later:Patch version 10.3.26 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-management-data-center","product_name":"Jira Service Management Data Center","version_start":"Patch version 5.12.40 and later","version_start_inclusive":true,"version_end":"Patch version 5.12.40 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-service-management-data-center:Patch version 5.12.40 and later:Patch version 5.12.40 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-management-data-center","product_name":"Jira Service Management Data Center","version_start":"Patch version 11.3.12 and later","version_start_inclusive":true,"version_end":"Patch version 11.3.12 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-service-management-data-center:Patch version 11.3.12 and later:Patch version 11.3.12 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-management-data-center","product_name":"Jira Service Management Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-service-management-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-management-server","product_name":"Jira Service Management Server","version_start":"Patch version 5.12.40 and later","version_start_inclusive":true,"version_end":"Patch version 5.12.40 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-service-management-server:Patch version 5.12.40 and later:Patch version 5.12.40 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-service-management-server","product_name":"Jira Service Management Server","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-service-management-server:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-software-data-center","product_name":"Jira Software Data Center","version_start":"Patch version 11.3.12 and later","version_start_inclusive":true,"version_end":"Patch version 11.3.12 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-software-data-center:Patch version 11.3.12 and later:Patch version 11.3.12 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-software-data-center","product_name":"Jira Software Data Center","version_start":"Patch version 10.3.26 and later","version_start_inclusive":true,"version_end":"Patch version 10.3.26 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-software-data-center:Patch version 10.3.26 and later:Patch version 10.3.26 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-software-data-center","product_name":"Jira Software Data Center","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-software-data-center:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-software-data-center","product_name":"Jira Software Data Center","version_start":"Patch version 9.12.40 and later","version_start_inclusive":true,"version_end":"Patch version 9.12.40 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-software-data-center:Patch version 9.12.40 and later:Patch version 9.12.40 and later"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-software-server","product_name":"Jira Software Server","version_start":"All other versions","version_start_inclusive":true,"version_end":"All other versions","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-software-server:All other versions:All other versions"},{"vendor_slug":"atlassian","vendor_name":"Atlassian","product_slug":"jira-software-server","product_name":"Jira Software Server","version_start":"Patch version 9.12.40 and later","version_start_inclusive":true,"version_end":"Patch version 9.12.40 and later","version_end_inclusive":true,"cpe23_uri":"cve5:atlassian:jira-software-server:Patch version 9.12.40 and later:Patch version 9.12.40 and later"}],"exploit_refs":[{"source":"nuclei","kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml","title":"Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read","author":"Kazgangap,DhiyaneshDk,watchtowr","disclosed_at":null}],"news":[{"id":2392,"source":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/","title":"Hackers exploit critical Atlassian flaw after public PoC release","summary":"A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. [...]","thumbnail_url":null,"author":"Bill Toulas","published_at":"2026-10-07T12:49:01Z","fetched_at":"2026-10-07T13:20:29.329606Z","trending_score":0.0017826936131158152,"cve_ids":["CVE-2026-21589"]},{"id":2390,"source":"The Hacker News","url":"https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html","title":"Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details","summary":"Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.\n\nThe arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEityRbZfy1N9Y0SuqWl7yeWTYMjeirrTbDx719fM65Be6yXOt2Zl0YweAi0hAfswNzV_LrHa4eFCpcCemC3FNwxZve4bPkSelQiRnCdXpZofAnI7Si96nULBV6i25jgFaZkEY1T3LuPRhj6QzTSsWHZtLuoH1zXlLKZN3WwSiKS7QoY_Zug0CtaaCGozT6N/s1600/jira-attack.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-10-07T11:49:26Z","fetched_at":"2026-10-07T12:35:29.543106Z","trending_score":0.0016221338827260034,"cve_ids":["CVE-2026-21589"]},{"id":2373,"source":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-file-access-flaw-in-jira-confluence/","title":"Atlassian warns of critical file-access flaw in Jira, Confluence","summary":"Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]","thumbnail_url":null,"author":"Bill Toulas","published_at":"2026-10-06T17:34:59Z","fetched_at":"2026-10-06T18:17:34.535003Z","trending_score":0.0013503681234245631,"cve_ids":["CVE-2026-21589"]},{"id":2359,"source":"The Hacker News","url":"https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html","title":"Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products","summary":"A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory.\n\nThe attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGQge2pd9O29G6qjsswRMYKnpM66wzyEWHOnRljkIZUZpCGVGACovyKIiji1HQ4jZOsypuaveJUBxx0r7-tT-Icd3COeo_prgm0TbMWDJBYFYpWHOC3lBjb8sZo6f2qWPkzeztOAjMW1CjrE_fDe3nWBU2FEOOjUWDpNUbtY1okTyx_iFE7xcI5jxOeiQ/s1600/file.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-10-06T06:58:56Z","fetched_at":"2026-10-06T07:47:34.655681Z","trending_score":0.0010695655045005375,"cve_ids":["CVE-2026-21589"]}],"references":[{"url":"https://jira.atlassian.com/browse/BAM-26567","source_type":"MISC","tags":[]},{"url":"https://jira.atlassian.com/browse/BSERV-20604","source_type":"MISC","tags":[]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-104488","source_type":"MISC","tags":[]},{"url":"https://jira.atlassian.com/browse/CRUC-8741","source_type":"MISC","tags":[]},{"url":"https://jira.atlassian.com/browse/CWD-6610","source_type":"MISC","tags":[]},{"url":"https://jira.atlassian.com/browse/FE-7583","source_type":"MISC","tags":[]},{"url":"https://jira.atlassian.com/browse/JRASERVER-79546","source_type":"MISC","tags":[]},{"url":"https://jira.atlassian.com/browse/JSDSERVER-16809","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2026-10-05T21:30:00.390000Z","label":"CVE published","source":null},{"type":"first_article","at":"2026-10-06T06:58:56Z","label":"First news coverage","source":"The Hacker News"},{"type":"poc_available","at":"2026-10-07T21:36:29.212935Z","label":"Public PoC available","source":"nuclei"},{"type":"cisa_reported","at":"2026-10-15T00:00:00Z","label":"Added to CISA KEV catalog","source":"kev"},{"type":"cvss_changed","at":"2026-10-23T01:25:46.062851Z","label":"CVSS score revised","source":"nvd"},{"type":"cvss_changed","at":"2026-10-23T01:25:46.062851Z","label":"CVSS score revised","source":"nvd"},{"type":"cvss_changed","at":"2026-10-23T01:25:46.062851Z","label":"CVSS score revised","source":"nvd"}]}