CVE-2026-21589 - Vulnerability Details

- Arbitrary File Access in Atlassian Data Center Products

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Published: 2026-10-05

Score: 9.3 Critical

EPSS: 1.8% Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Atlassian

Bamboo Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 10.2.24 and later`	unaffected	—
`Patch version 12.1.12 and later`	unaffected	—

Atlassian

Bitbucket Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 10.2.8 and later`	unaffected	—
`Patch version 10.5.1 and later`	unaffected	—
`Patch version 9.4.26 and later`	unaffected	—

Atlassian

Confluence Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 10.2.19 and later`	unaffected	—
`Patch version 9.2.26 and later`	unaffected	—

Atlassian

Crowd Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 7.2.4 and later`	unaffected	—
`Patch version 7.1.7 and later`	unaffected	—
`Patch version 7.0.3 and later`	unaffected	—
`Patch version 6.3.7 and later`	unaffected	—

Atlassian

Crucible Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 4.9.15 and later`	unaffected	—

Atlassian

Fisheye Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 4.9.15 and later`	unaffected	—

Atlassian

Jira Service Management Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 11.3.12 and later`	unaffected	—
`Patch version 10.3.26 and later`	unaffected	—
`Patch version 5.12.40 and later`	unaffected	—

Atlassian

Jira Software Data Center

affected

Version	Status	Constraints
`All other versions`	affected	—
`Patch version 11.3.12 and later`	unaffected	—
`Patch version 10.3.26 and later`	unaffected	—
`Patch version 9.12.40 and later`	unaffected	—

No data.

Vendor Product Confidence Versions

Atlassian

Bamboo Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[10.2.4,*]`	unaffected	semver	—
`[12.1.12,*]`	unaffected	semver	—

Atlassian

Bamboo Server

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Atlassian

Bitbucket Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[10.2.8,*]`	unaffected	semver	—
`[10.5.1,*]`	unaffected	semver	—
`[9.4.26,*]`	unaffected	semver	—

Atlassian

Bitbucket Server

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Atlassian

Confluence Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[10.2.19,*]`	unaffected	semver	—
`[9.2.26,*]`	unaffected	semver	—

Atlassian

Confluence Server

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Atlassian

Crowd Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[7.2.4,*]`	unaffected	semver	—
`[7.1.1,*]`	unaffected	semver	—
`[7.0.3,*]`	unaffected	semver	—
`[6.3.7,*]`	unaffected	semver	—

Atlassian

Crucible

84%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[4.9.15,*]`	unaffected	semver	—

Atlassian

Crucible Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[4.9.15,*]`	unaffected	semver	—

Atlassian

Fisheye

83%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[4.9.15,*]`	unaffected	semver	—

Atlassian

Fisheye Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[4.9.15,*]`	unaffected	semver	—

Atlassian

Jira Server

84%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Atlassian

Jira Service Management

90%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[5.12.40,*]`	unaffected	semver	—

Atlassian

Jira Service Management Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[11.3.12,*]`	unaffected	semver	—
`[10.3.26,*]`	unaffected	semver	—
`[5.12.40,*]`	unaffected	semver	—

Atlassian

Jira Software Data Center

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[11.3.12,*]`	unaffected	semver	—
`[10.3.26,*]`	unaffected	semver	—
`[9.12.40,*]`	unaffected	semver	—

Atlassian

Jira Software Server

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—
`[9.12.40,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01755.

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
https://jira.atlassian.com/browse/BAM-26567
https://jira.atlassian.com/browse/BSERV-20604
https://jira.atlassian.com/browse/CONFSERVER-104488
https://jira.atlassian.com/browse/CRUC-8741
https://jira.atlassian.com/browse/CWD-6610
https://jira.atlassian.com/browse/FE-7583
https://jira.atlassian.com/browse/JRASERVER-79546
https://jira.atlassian.com/browse/JSDSERVER-16809

History

Wed, 07 Oct 2026 15:15:00 +0000

Type	Values Removed	Values Added
Title	Arbitrary File Access in Atlassian Data Center Products

Wed, 07 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 07 Oct 2026 09:15:00 +0000

Type	Values Removed	Values Added
Title		Arbitrary File Access in Atlassian Data Center Products

Wed, 07 Oct 2026 07:15:00 +0000

Type	Values Removed	Values Added
Title	Unauthenticated Remote Arbitrary File Access in Atlassian Data Center Products
Weaknesses	CWE-200 CWE-284

Wed, 07 Oct 2026 06:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 06 Oct 2026 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Atlassian Atlassian bamboo Data Center Atlassian bamboo Server Atlassian bitbucket Data Center Atlassian bitbucket Server Atlassian confluence Data Center Atlassian confluence Server Atlassian crowd Data Center Atlassian crucible Atlassian crucible Data Center Atlassian fisheye Atlassian fisheye Data Center Atlassian jira Server Atlassian jira Service Management Atlassian jira Service Management Data Center Atlassian jira Software Data Center Atlassian jira Software Server
Vendors & Products		Atlassian Atlassian bamboo Data Center Atlassian bamboo Server Atlassian bitbucket Data Center Atlassian bitbucket Server Atlassian confluence Data Center Atlassian confluence Server Atlassian crowd Data Center Atlassian crucible Atlassian crucible Data Center Atlassian fisheye Atlassian fisheye Data Center Atlassian jira Server Atlassian jira Service Management Atlassian jira Service Management Data Center Atlassian jira Software Data Center Atlassian jira Software Server

Tue, 06 Oct 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description	h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents.	This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Tue, 06 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-552
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 05 Oct 2026 22:45:00 +0000

Type	Values Removed	Values Added
Title		Unauthenticated Remote Arbitrary File Access in Atlassian Data Center Products
Weaknesses		CWE-200 CWE-284

Mon, 05 Oct 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description		h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents.
References		https://jira.atlassian.com/browse/BAM-26567 https://jira.atlassian.com/browse/BSERV-20604 https://jira.atlassian.com/browse/CONFSERVER-104488 https://jira.atlassian.com/browse/CRUC-8741 https://jira.atlassian.com/browse/CWD-6610 https://jira.atlassian.com/browse/FE-7583 https://jira.atlassian.com/browse/JRASERVER-79546 https://jira.atlassian.com/browse/JSDSERVER-16809
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}`

Subscriptions

Atlassian Bamboo Data Center Bamboo Server Bitbucket Data Center Bitbucket Server Confluence Data Center Confluence Server Crowd Data Center Crucible Crucible Data Center Fisheye Fisheye Data Center Jira Server Jira Service Management Jira Service Management Data Center Jira Software Data Center Jira Software Server

MITRE

Status: PUBLISHED

Assigner: atlassian

Published: 2026-10-05T21:30:00.390Z

Updated: 2026-10-07T13:04:58.027Z

Reserved: 2026-01-01T00:00:40.722Z

Link: CVE-2026-21589

Vulnrichment

Updated: 2026-10-06T13:51:25.309Z

NVD

Status : Awaiting Analysis

Published: 2026-10-05T22:16:58.423

Modified: 2026-10-07T13:17:22.273

Link: CVE-2026-21589

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-07T15:00:07Z

Weaknesses

CWE-552
Files or Directories Accessible to External Parties

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Exploitation poc

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object