Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
TL;DR 📌
- Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected…
- Highest CVSS: 9.3 (Critical).
- Listed in CISA KEV (2026-10-15) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-21589.
What it is
CVE-2026-21589 is a files-or-directories-accessible-to-external-parties flaw affecting a wide spread of Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. The underlying issue is arbitrary file access within the web application root — the application serves up files it shouldn’t to requests that never need to authenticate.
The attack path is unauthenticated and over the network: no credentials, no prior session, just a request to the right path. There’s a limiting factor, though — exploitation requires the attacker to already know the exact file name and path they’re after. The vulnerability does not provide directory listing or enumeration, so an attacker can’t browse to find targets; they have to guess or already know what’s there.
What they get, if they guess correctly, is read access to files inside the web root. Atlassian’s own description notes that in some configurations this can expose sensitive files, which is why the severity is rated as high as it is despite the “must know the exact path” caveat. No data modification or availability impact is indicated — this is a read-only disclosure issue, but the files involved can matter a great deal depending on what’s deployed alongside the application.
This is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 15 October 2026, so it is known to be exploited.
What to do
- Patch according to the product you run. Fix versions are: Bitbucket Data Center 9.4.26 / 10.2.8 / 10.5.1; Confluence Data Center 9.2.26 / 10.2.19; Crowd Data Center 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Jira Software Data Center 9.12.40 / 10.3.26 / 11.3.12; Jira Service Management Data Center 5.12.40 / 10.3.26 / 11.3.12; Bamboo Data Center 10.2.24 / 12.1.12; Crucible 4.9.15; Fisheye 4.9.15.
- Check which affected products you’re running against the introduced-version ranges in the advisory (e.g. Bitbucket Data Center from 4.6.0, Confluence Data Center from 5.10.0, Jira Software Data Center from 7.1.0, Jira Service Management Data Center from 3.1.0, Bamboo Data Center from 7.0.1, Crowd Data Center from 2.11.0) — if you’re on an earlier release the flaw doesn’t apply, but confirm against your actual version string rather than assuming.
- Given this is in CISA KEV, treat patching as urgent rather than scheduled maintenance; this is already being exploited in the wild.
- While patching is pending, review what sensitive files sit inside the web application root for each of these instances — configuration files, credentials, backups — since the impact here depends heavily on what an attacker could reach if they guessed correctly.
- After patching, check web server and application logs for requests to unusual or unexpected file paths predating the fix, since the access pattern here is targeted file requests rather than broad scanning.
For leadership 🧭
Executive summary. Attackers who have learned the right file path can read sensitive files - configuration data, credentials, backups - from internet-facing Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible or Fisheye Data Center instances without logging in. This is already listed in CISA’s Known Exploited Vulnerabilities catalogue, so it needs treating as an active incident risk, not routine patch-cycle work.
Why it matters:
- Eight separate Data Center products are affected - Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye - so a single organisation running several of these tools has multiple exposed instances to check, not just one.
- No credentials or session are required; the request goes straight to the web application root, meaning any internet-facing instance is reachable by an outside party without prior access.
- The flaw cannot be used to browse or enumerate files, but an attacker who has learned or guessed a specific configuration, credential or backup file path can read it in full, and Atlassian itself flags some deployments as holding genuinely sensitive files there.
- CISA added this to its Known Exploited Vulnerabilities list on 15 October 2026, meaning the scanning or exploitation attempts are not theoretical.
Now / Next / Later:
- Now: Identify every internet-facing instance of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible or Fisheye Data Center and confirm its exact version against the introduced-version ranges (e.g. Bitbucket from 4.6.0, Confluence from 5.10.0) to establish which ones are actually affected.
- Next: Patch each affected product to its fixed release in the next available change window - Bitbucket Data Center 9.4.26/10.2.8/10.5.1, Confluence Data Center 9.2.26/10.2.19, Crowd Data Center 6.3.7/7.0.3/7.1.7/7.2.4, Jira Software Data Center 9.12.40/10.3.26/11.3.12, Jira Service Management Data Center 5.12.40/10.3.26/11.3.12, Bamboo Data Center 10.2.24/12.1.12, Crucible 4.9.15, Fisheye 4.9.15 - and treat it as urgent given the KEV listing rather than scheduled maintenance.
- Later: Review what configuration files, credentials or backups sit inside the web application root for each of these tools, and check web server logs for requests to unusual or unexpected file paths predating the patch, since any successful guess would have left a targeted, not broad-scan, access trace.