CVE-2026-21589 - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affecte
- Severity
- critical
- Product
- Atlassian Multiple Products
- Published
- 2026-10-15
- EPSS
- 0.995
- CISA KEV
- Known exploited
- Ransomware
- Known campaign use
References and validation
- https://github.com/search?q=CVE-2026-21589&type=repositories
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2026-21589
Entries are refreshed from CISA KEV and FIRST EPSS. Validate applicability before testing.