Atlassian Data Center CVE-2026-21589 in CISA KEV: Unauthenticated File Read Across 8 Products

On October 15, 2026, CISA added CVE-2026-21589 to its KEV catalog, with a deadline of October 18 — three days. The flaw spans almost the entire Atlassian Data Center line: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye.

The score is "only" 7.5. Don't let the number fool you: CISA listed it because it's being exploited.

What the Flaw Does

This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions.

An unauthenticated attacker can read files located under the web application root. Two limits, stated by Atlassian and echoed by NVD:

• the attacker needs to know the exact name and path of the target file;
• the flaw can't list directory contents.

No write, no code execution: the vector is C:H/I:N/A:N, confidentiality only.

Why It Still Matters

"You need the exact path" protects less than it sounds. These are commercial products shipped identically: the web root layout is the same from one installation to the next. An attacker doesn't have to guess — they know where to look.

Atlassian says so itself: depending on configuration, some sensitive files can make this highly severe. In practice, think of everything that may have been dropped under the web root over the years: configuration files, exports, backups, customisations. A leaked credential or integration secret turns a file read into full access.

And the surface is wide: a Jira or Confluence exposed to the internet for contractors is common. For more on Confluence's track record, see our article on Atlassian Confluence vulnerabilities.

Fixed Versions

The NVD description explicitly lists fixed versions, per branch:

Read it per branch: on a Jira 10.3.x branch the target is 10.3.26; on 9.12.x, 9.12.40. NVD's CPE configuration also mentions Bitbucket Server 8.14.6, though the description doesn't call it a fixed version: check the Atlassian advisory to see whether your Server version is covered. If your branch isn't listed at all, it's probably out of support — you'll need to move to a fixed branch.

Detection

• Reverse proxy access logs: unauthenticated requests to unusual paths, especially static or configuration files never requested in normal use.
• Bursts of 404s followed by 200s from one source: a sign of probing known paths.
• Web root inventory: list anything there that isn't part of the standard installation (backups, exports, files left by a script).
• Use of secrets stored on the server (service accounts, integration tokens) from an unexpected origin.

Mitigation

1. Upgrade to your branch's fixed version on every affected product, before October 18 if you're bound by the CISA directive — and as soon as possible otherwise.
2. If you can't upgrade right away: remove direct internet exposure and put the instance behind a VPN or an authenticating proxy.
3. Clean up the web root: nothing that isn't part of the application belongs there.
4. If past exposure is uncertain: treat sensitive files reachable under the web root as read, and rotate the secrets they contain.

Why Continuous Monitoring of Your Atlassian Estate Matters

Eight products, a couple of dozen branches, different fixed versions for each: knowing within three days which server must move to which release means having the inventory before the alert, not after.

With cveo.tech, inventory your Atlassian instances with exact versions and get alerted whenever a CISA KEV CVE affects them.