CVE detail
CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Source: CISA Known Exploited Vulnerabilities catalog · back to feed
Vendor / product
Atlassian · Multiple Products
- Date added (KEV)
- Oct 15, 2026
- CISA due date
- Oct 18, 2026
- Ransomware campaign use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor fix: Vendor mitigation
Scorifya interpretation
AI-generatedA short, structured read of the record above, generated when this page first loads, then cached for a week.
Plain English
Technical detail
From CISA
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589
See what attackers can see on your domain
This vulnerability is on CISA's Known Exploited Vulnerabilities list, so it is being exploited in the wild right now. Scorifya can't test for Atlassian directly, but in about 30 seconds it shows what your own domain exposes publicly across TLS, security headers, DNS, and cookies: the surface attackers probe first.
SOC 2 compliance
Tracking remediation across your cloud infrastructure?
Scorifya Controls automates 54 SOC 2 checks across AWS, GitHub, GCP, and Azure, and gives you a manual evidence trail for the controls no tool can automate. Self-hosted, three tiers from $149/mo.
See Scorifya Controls →References
- https://jira.atlassian.com/browse/BAM-26567Issue TrackingMitigationVendor Advisory
- https://jira.atlassian.com/browse/BSERV-20604Issue TrackingMitigationVendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-104488Issue TrackingMitigationVendor Advisory
- https://jira.atlassian.com/browse/CRUC-8741Issue TrackingMitigationVendor Advisory
- https://jira.atlassian.com/browse/CWD-6610Issue TrackingMitigationVendor Advisory
- https://jira.atlassian.com/browse/FE-7583Issue TrackingMitigationVendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-79546Issue TrackingMitigationVendor Advisory
- https://jira.atlassian.com/browse/JSDSERVER-16809Issue TrackingMitigationVendor Advisory
- https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589US Government Resource
Other recent CVEs from Atlassian
- CVE-2021-26086Jira Server and Data Center, Atlassian Jira Server and Data Center Path Traversal Vulnerability
- CVE-2023-22527Confluence Data Center and Server, Atlassian Confluence Data Center and Server Template Injection Vulnerability
- CVE-2023-22518Confluence Data Center and Server, Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
- CVE-2023-22515Confluence Data Center and Server, Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
- CVE-2022-36804Bitbucket Server and Data Center, Atlassian Bitbucket Server and Data Center Command Injection Vulnerability