NetSight
IP …
high7.5Known exploited

CVE-2026-21589

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-10-15. Federal due date: 2026-10-18.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Impact

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Affected products

VendorProductAffected versions
AtlassianBitbucket Data Center
from 7.17.0 before 9.4.26
from 9.5.0 before 10.2.8
from 10.3.0 before 10.5.1
AtlassianBitbucket Server
from 4.6.0 through 8.14.6
AtlassianConfluence Data Center
from 5.10.0 before 9.2.26
from 9.3.0 before 10.2.19
AtlassianCrowd
from 2.11.0 before 6.3.7
from 7.0.0 before 7.0.3
from 7.1.0 before 7.1.7
from 7.2.0 before 7.2.4
AtlassianJira Data Center
from 7.1.0 before 9.12.40
from 9.13.0 before 10.3.26
from 10.4.0 before 11.3.12
AtlassianJira Service Desk
from 3.1.0 through 4.13.27
AtlassianJira Service Management
from 4.14.0 before 5.12.40
from 5.13.0 before 10.3.26
from 10.4.0 before 11.3.12
AtlassianBamboo
from 7.0.1 before 10.2.24
from 11.0.0 before 12.1.12
AtlassianCrucible
before 4.9.15
AtlassianFisheye
before 4.9.15

Weakness classification

CWE-552

References