Atlassian CVE-2026-21589: exploited file access flaw, how to fix it

TL;DR

• What: CVE-2026-21589 is an arbitrary file access flaw that affects eight Atlassian products, including Confluence Data Center, Jira and Bitbucket Data Center.
• Impact: an unauthenticated attacker on the network can read specific files under the web application root, if they know the exact file name and path.
• Severity: a CVSS v4.0 score of 9.3 (critical) and a CVSS v3.1 score of 7.5 (high) from NIST, weakness class CWE-552.
• Exploited: yes. CISA added it to the Known Exploited Vulnerabilities catalogue on October 15, 2026, and its due date was October 18, 2026.
• Fix: upgrade each product to its fixed version, for example Confluence Data Center 10.2.19 or 9.2.26.

What CVE-2026-21589 is

Atlassian sells a family of team tools that companies usually run on their own servers: Confluence for documentation, Jira Software and Jira Service Management for tickets, Bitbucket for source code, Bamboo for builds and Crowd for single sign-on. Crucible and Fisheye are code review and code browsing tools. CVE-2026-21589 affects all of them in the versions listed below.

The National Vulnerability Database describes an arbitrary file access flaw. An unauthenticated remote attacker can fetch specific files from inside the web application root directory of an affected product. CISA's catalogue entry names the same weakness: files or directories accessible to external parties, tracked as CWE-552.

There is an important limit. NVD says exploitation requires prior knowledge of the exact name and path of the target file, and that the flaw does not let an attacker enumerate or list directory contents. That narrows the attack, but NVD also warns that in some configurations sensitive files may be reachable, which makes the issue highly severe. Think of configuration files, exported data or anything else an administrator left under the web root.

Why it matters now

This is an exploited flaw, not a theoretical one. CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalogue on October 15, 2026, and set a remediation due date of October 18, 2026. That date has passed. The NVD entry was published on October 5, 2026 and its status is Analyzed.

The severity scores differ by scoring system. NVD shows a CVSS v4.0 base score of 9.3, rated critical, and a CVSS v3.1 base score of 7.5, rated high, scored by NIST. The v3.1 vector is network reachable, low complexity, no privileges and no user interaction, with a high impact on confidentiality only. In plain terms: anyone who can reach the server over the network can try, and what they gain is data.

CISA lists known ransomware campaign use as unknown. Its required action is to apply mitigations in line with the vendor's instructions, or to stop using the product if mitigations are not available. Collaboration servers are often reachable from the internet, hold design documents and credentials, and are patched late, which is why this kind of flaw shows up in attacker playbooks. We saw the same pattern in our write-up of an exploited GitLab flaw and of an exploited Collabora flaw.

Am I affected?

You are affected if you run any of these products below its fixed version. NVD lists the ranges as follows, and each range stops before the fixed version:

• Confluence Data Center: fixed in 10.2.19 or 9.2.26.
• Jira Software Data Center: fixed in 11.3.12, 10.3.26 or 9.12.40.
• Jira Service Management Data Center: fixed in 11.3.12, 10.3.26 or 5.12.40.
• Bitbucket Data Center: fixed in 10.5.1, 10.2.8 or 9.4.26.
• Bamboo Data Center: fixed in 12.1.12 or 10.2.24.
• Crowd Data Center: fixed in 7.2.4, 7.1.7, 7.0.3 or 6.3.7.
• Crucible and Fisheye: fixed in 4.9.15.

The fixed version depends on your release line, so match your current version to the closest line and upgrade within it, or move to a newer line. The affected ranges in NVD also cover Bitbucket Server up to 8.14.6 and Jira Service Desk up to 4.13.27, which are older products. If you run those, plan an upgrade to a supported product, because the fixed versions above do not apply to them.

To check one machine by hand, find the Atlassian installs first, then read the version from the product itself:

ps aux | grep -i -E 'confluence|jira|bitbucket|bamboo|crowd|fisheye|crucible'
ls -d /opt/atlassian* /var/atlassian*
find / -maxdepth 4 -type d \( -iname 'confluence*' -o -iname 'jira*' -o -iname 'bitbucket*' \) 2>/dev/null
docker ps

The first command shows running processes, the second and third look for install and data directories (adjust the paths to your layout), and the last lists containers so you can check images too. Then open the product's administration area and read its version, which each product shows in its About or System information page. If the version is below the fixed version for its release line, treat the server as vulnerable.

A note on distributions: these are vendor products, normally installed from Atlassian's own installer or archive, so distribution backports do not apply. Do not assume that an operating system update changed the product version. Read the version from the product.

How to fix CVE-2026-21589

The fix is to upgrade each affected product to a fixed version. Work through these steps in order:

1. List every Atlassian server and container you run, including test and staging systems, and record the product and exact version of each using the commands above.
2. Upgrade each product to the fixed version for its release line, for example Confluence Data Center to 10.2.19 or 9.2.26, Jira Software Data Center to 11.3.12, 10.3.26 or 9.12.40, and Bitbucket Data Center to 10.5.1, 10.2.8 or 9.4.26. Confirm the release line in Atlassian's own security advisory, which the CISA entry links.
3. If you cannot upgrade at once, follow Atlassian's mitigation instructions, restrict network access to the server to the people who need it, and move anything sensitive out of the web application root. CISA's required action says to stop using the product if mitigations are not available.
4. Because the flaw is exploited, look for signs that files were read while the server was exposed. Check web server and application logs for unusual requests to file paths under the web root, and rotate any secret that sat in a file an outsider could have fetched. CISA asks for forensics triage when exploitation may have happened.
5. Run your inventory check again and confirm that no instance still reports a version below its fixed version.

Our guide to remediation in Stackurity explains how an upgrade card lists the version to move to and every issue it clears.

How to check with Stackurity

Stackurity keeps one live inventory of the software on your servers, deployed applications, repositories and container images. A read-only agent on Linux servers reads installed packages, runtimes installed by hand and the libraries that deployed applications actually load. The inventory is matched against new vulnerability advisories and the CISA Known Exploited Vulnerabilities catalogue every hour. Each finding is ranked from exploitation, exposure and environment and says in one sentence why it applies, so an entry in the exploited catalogue moves to the top of the list.

For this flaw, Stackurity can find server software such as Confluence when the agent sees it on Linux servers or in images. After you upgrade, the check again function asks the agent for a fresh report and records whether the issue is passed, partly fixed or still open, so you can show that the fix worked. The verification guide describes that step.

Be clear about the limits. Stackurity does not cover network appliance firmware, and it does not assess libraries copied into an application outside a package manager or lockfile, apart from the front-end libraries it recognises by their version banner. An Atlassian product unpacked from an archive may fall in that gap, so use the hand check above to confirm each instance. The core is open source, and Stackurity Cloud has a 14-day free trial without a card: start a free trial.

FAQ

Is CVE-2026-21589 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalogue on October 15, 2026, with a due date of October 18, 2026. CISA lists known ransomware campaign use as unknown.

Which Atlassian products does CVE-2026-21589 affect?

The Data Center editions of Confluence, Jira Software, Jira Service Management, Bitbucket, Bamboo and Crowd, plus Crucible and Fisheye, in the affected versions.

Can an attacker list the files on the server?

No. The National Vulnerability Database says exploitation requires prior knowledge of the exact file name and path, and the flaw does not let an attacker list directory contents. It can still be serious when a sensitive file sits under the web application root.

What is the fix for Confluence Data Center?

Move to 10.2.19 or 9.2.26, which are the fixed versions in the National Vulnerability Database entry. Check Atlassian's own advisory for the release line that suits you.

How severe is CVE-2026-21589?

NVD records a CVSS v3.1 score of 7.5 (high) from NIST and a CVSS v4.0 score of 9.3 (critical). The weakness class is CWE-552, files or directories accessible to external parties.

Does Stackurity find these Atlassian products?

Stackurity's agent looks for server software such as Confluence on Linux servers and in images. Check the version by hand for any Atlassian product that runs from an unpacked archive, and note that Stackurity does not cover network appliance firmware.

Sources: CISA Known Exploited Vulnerabilities catalogue, NIST National Vulnerability Database and Stackurity product facts.