Critical 9.3Known exploited (CISA KEV)Published Oct 5, 2026

CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.

Updated under an hour ago (Oct 27, 2026, 2:50 PM ET)

Does this affect you?

It affects Atlassian Bamboo Data Center and 15 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Oct 15, 2026; federal agencies had to remediate by Oct 18, 2026. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Atlassian Bamboo Data Center

Exploited in the last 30 days

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness (CWE): CWE-552
Known exploited: Added to CISA KEV Oct 15, 2026; federal remediation due Oct 18, 2026Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
EPSS (exploitation in the next 30 days): 99.48% (percentile 100)
Assigned by: atlassian
NVD analysis: Analyzed
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Atlassian Bamboo Data Center atlassian:bamboo_data_center (from the name)	All other versions; Patch version 10.2.24 and later not affected; Patch version 12.1.12 and later not affected	CNA record
Atlassian Bitbucket Data Center atlassian:bitbucket_data_center (from the name)	All other versions; Patch version 10.2.8 and later not affected; Patch version 10.5.1 and later not affected; Patch version 9.4.26 and later not affected	CNA record
Atlassian Confluence Data Center atlassian:confluence_data_center (from the name)	All other versions; Patch version 10.2.19 and later not affected; Patch version 9.2.26 and later not affected	CNA record
Atlassian Crowd Data Center atlassian:crowd_data_center (from the name)	All other versions; Patch version 7.2.4 and later not affected; Patch version 7.1.7 and later not affected; Patch version 7.0.3 and later not affected; Patch version 6.3.7 and later not affected	CNA record
Atlassian Crucible Data Center atlassian:crucible_data_center (from the name)	All other versions; Patch version 4.9.15 and later not affected	CNA record
Atlassian Fisheye Data Center atlassian:fisheye_data_center (from the name)	All other versions; Patch version 4.9.15 and later not affected	CNA record
Atlassian Jira Service Management Data Center atlassian:jira_service_management_data_center (from the name)	All other versions; Patch version 11.3.12 and later not affected; Patch version 10.3.26 and later not affected; Patch version 5.12.40 and later not affected	CNA record
Atlassian Jira Software Data Center atlassian:jira_software_data_center (from the name)	All other versions; Patch version 11.3.12 and later not affected; Patch version 10.3.26 and later not affected; Patch version 9.12.40 and later not affected	CNA record
atlassian bitbucket_data_center atlassian:bitbucket_data_center	from 7.17.0 before 9.4.26; from 9.5.0 before 10.2.8; from 10.3.0 before 10.5.1	NVD
atlassian bitbucket_server atlassian:bitbucket_server	from 4.6.0 through 8.14.6	NVD
1–10 of 18

References

References

https://jira.atlassian.com/browse/BAM-26567	issue-tracking, mitigation, vendor-advisory
https://jira.atlassian.com/browse/BSERV-20604	issue-tracking, mitigation, vendor-advisory
https://jira.atlassian.com/browse/CONFSERVER-104488	issue-tracking, mitigation, vendor-advisory
https://jira.atlassian.com/browse/CRUC-8741	issue-tracking, mitigation, vendor-advisory
https://jira.atlassian.com/browse/CWD-6610	issue-tracking, mitigation, vendor-advisory
https://jira.atlassian.com/browse/FE-7583	issue-tracking, mitigation, vendor-advisory
https://jira.atlassian.com/browse/JRASERVER-79546	issue-tracking, mitigation, vendor-advisory
https://jira.atlassian.com/browse/JSDSERVER-16809	issue-tracking, mitigation, vendor-advisory
https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.