CVE-2026-21589: Critical Flaw in Atlassian Data Center Products

What CVE-2026-21589 is and who is affectedCVE-2026-21589 is an arbitrary file access vulnerability (CWE-552) affecting multiple Atlassian products: Bi...

What CVE-2026-21589 is and who is affected

CVE-2026-21589 is an arbitrary file access vulnerability (CWE-552) affecting multiple Atlassian products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. According to the National Vulnerability Database (NVD), an unauthenticated attacker can access specific files inside the web application root directory in affected versions. The flaw does not allow directory listing or enumeration: the attacker must already know the exact name and path of the target file. In some configurations, sensitive files may be present, which is what makes this highly severe.

The NVD rates it CVSS 4.0 9.3, critical. The affected version ranges are wide. For Bitbucket Data Center, versions from 7.17.0 up to (but not including) 9.4.26, from 9.5.0 up to 10.2.8, and from 10.3.0 up to 10.5.1 are affected. Bitbucket Server is affected from 4.6.0 up to and including 8.14.6. Confluence Data Center is affected from 5.10.0 up to 9.2.26 and from 9.3.0 up to 10.2.19. Crowd is affected from 2.11.0 up to 6.3.7, from 7.0.0 up to 7.0.3, from 7.1.0 up to 7.1.7 and from 7.2.0 up to 7.2.4. Jira Data Center is affected from 7.1.0 up to 9.12.40 and from 9.13.0 up to 10.3.26. Bamboo Data Center is affected from 7.0.1 onwards. Crucible and Fisheye are also affected. The NVD lists further configurations beyond these.

Why it is urgent: already exploited in real attacks

This is not a theoretical risk. CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalogue on 15 October 2026, which means it is being exploited in real attacks. CISA has set a remediation deadline of 18 October 2026 for US federal agencies. The required action is to apply mitigations in accordance with the vendor's instructions and to follow CISA's BOD 26-04 guidance on prioritising security updates based on risk, as well as its forensics triage requirements. Where mitigations are unavailable, CISA advises discontinuing use of the product. There is no record of this vulnerability being used in ransomware campaigns, but the KEV listing alone justifies treating it as a priority. The short window between publication on the NVD (5 October 2026) and the KEV addition shows how quickly attackers move.

What to do today

Start by taking inventory. Confirm whether your organisation runs any of the affected Atlassian products and, if so, which exact version. This matters because the fix versions differ per product: Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1; Confluence Data Center 9.2.26 and 10.2.19; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4; Jira Software Data Center and Jira Service Management Data Center 9.12.40, 10.3.26 and 11.3.12; Bamboo Data Center 10.2.24 and 12.1.12; Crucible and Fisheye 4.9.15. If your version falls inside an affected range, apply the update or mitigation described in Atlassian's advisory for that product. Do not rely on a generic patch: each product has its own issue tracking entry with mitigation details.

Check for signs of intrusion: unusual requests to files inside the web application root, unexpected access to configuration or credential files, and unfamiliar IP addresses in web server logs.
Reduce internet exposure. If an Atlassian instance does not need to be reachable from the public internet, put it behind a VPN or an access-controlled reverse proxy.
Review file permissions and remove any sensitive files that should not sit inside the web root.
Rotate credentials and secrets that may have been stored in files reachable through the web application root.

Because exploitation requires knowledge of the exact file name and path, an attacker who has already gathered information about your environment is better positioned. Treat any suspicious file access as a potential precursor and preserve logs for forensic review.

How a cybersecurity team such as ALMC's can help

For small and mid-sized companies in Spain with a small IT team, keeping on top of advisories like this one is a full-time job. At ALMC we work with businesses in Lleida, Barcelona, Tarragona and Girona on security audits and pentesting, server hardening, monitoring and incident response, and the maintenance and updating of platforms such as WordPress, PrestaShop and Joomla. In a case like CVE-2026-21589, that means helping you identify which Atlassian instances and versions you actually run, applying the vendor's fix or mitigation, checking logs for signs of unauthorised file access, and reducing what is exposed to the internet. We also repair websites that have already been compromised. The goal is simple: close the gap before someone else finds it.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.