CVE-2026-21589

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://jira.atlassian.com/browse/BAM-26567 Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/BSERV-20604 Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-104488 Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8741 Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/CWD-6610 Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/FE-7583 Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-79546 Issue Tracking Mitigation Vendor Advisory
https://jira.atlassian.com/browse/JSDSERVER-16809 Issue Tracking Mitigation Vendor Advisory
https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*

Configuration 7 (hide)

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Configuration 8 (hide)

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
History

26 Oct 2026, 10:10

Type Values Removed Values Added
Summary
  • (es) Esta es una vulnerabilidad en Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible y Fisheye. Esta vulnerabilidad de Acceso Arbitrario a Archivos permite a un atacante no autenticado acceder a archivos específicos dentro del directorio raíz de la aplicación web en las versiones afectadas. La explotación requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo; esta vulnerabilidad no permite a los atacantes enumerar o listar el contenido del directorio. En algunas configuraciones, puede haber archivos sensibles que la hacen altamente severa. Esta vulnerabilidad permite a un atacante remoto no autenticado acceder a archivos específicos dentro del directorio raíz de la aplicación web en las versiones afectadas. La vulnerabilidad debe abordarse para las versiones afectadas de: -- Bitbucket Data Center, introducida en la versión 4.6.0 o posteriores, con versiones corregidas: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introducida en la versión 5.10.0 o posteriores, con versiones corregidas: 9.2.26, 10.2.19 -- Crowd Data Center, introducida en la versión 2.11.0 o posteriores, con versiones corregidas: 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introducida en la versión 7.1.0 o posteriores, con versiones corregidas: 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introducida en la versión 3.1.0 o posteriores, con versiones corregidas: 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center, versiones 7.0.1 o posteriores, con versiones corregidas: 10.2.24, 12.1.12 -- Crucible, con versiones corregidas: 4.9.15 -- Fisheye, con versión corregida: 4.9.15 -- La explotación requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo. La vulnerabilidad no incluye la capacidad de enumerar o listar el contenido del directorio.

19 Oct 2026, 20:31

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
References () https://jira.atlassian.com/browse/BAM-26567 - () https://jira.atlassian.com/browse/BAM-26567 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/BSERV-20604 - () https://jira.atlassian.com/browse/BSERV-20604 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/CONFSERVER-104488 - () https://jira.atlassian.com/browse/CONFSERVER-104488 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/CRUC-8741 - () https://jira.atlassian.com/browse/CRUC-8741 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/CWD-6610 - () https://jira.atlassian.com/browse/CWD-6610 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/FE-7583 - () https://jira.atlassian.com/browse/FE-7583 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/JRASERVER-79546 - () https://jira.atlassian.com/browse/JRASERVER-79546 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/JSDSERVER-16809 - () https://jira.atlassian.com/browse/JSDSERVER-16809 - Issue Tracking, Mitigation, Vendor Advisory
References () https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 - () https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 - Third Party Advisory
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 - US Government Resource
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Atlassian jira Service Management
Atlassian crucible
Atlassian bitbucket Data Center
Atlassian
Atlassian bamboo
Atlassian crowd
Atlassian confluence Data Center
Atlassian fisheye
Atlassian bitbucket Server
Atlassian jira Data Center
Atlassian jira Service Desk

19 Oct 2026, 19:17

Type Values Removed Values Added
CWE CWE-552
Summary (en) Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record. (en) This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
References
  • () https://jira.atlassian.com/browse/BAM-26567 -
  • () https://jira.atlassian.com/browse/BSERV-20604 -
  • () https://jira.atlassian.com/browse/CONFSERVER-104488 -
  • () https://jira.atlassian.com/browse/CRUC-8741 -
  • () https://jira.atlassian.com/browse/CWD-6610 -
  • () https://jira.atlassian.com/browse/FE-7583 -
  • () https://jira.atlassian.com/browse/JRASERVER-79546 -
  • () https://jira.atlassian.com/browse/JSDSERVER-16809 -
  • () https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 -
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 -

16 Oct 2026, 21:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : unknown
CPE cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
Summary (en) This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents. (en) Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.
References
  • {'url': 'https://jira.atlassian.com/browse/BAM-26567', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://jira.atlassian.com/browse/BSERV-20604', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://jira.atlassian.com/browse/CONFSERVER-104488', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://jira.atlassian.com/browse/CRUC-8741', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://jira.atlassian.com/browse/CWD-6610', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://jira.atlassian.com/browse/FE-7583', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://jira.atlassian.com/browse/JRASERVER-79546', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://jira.atlassian.com/browse/JSDSERVER-16809', 'tags': ['Issue Tracking', 'Mitigation', 'Vendor Advisory'], 'source': 'security@atlassian.com'}
  • {'url': 'https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589', 'tags': ['Third Party Advisory'], 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589', 'tags': ['US Government Resource'], 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}
CWE CWE-552

16 Oct 2026, 14:19

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
First Time Atlassian jira Service Desk

15 Oct 2026, 19:40

Type Values Removed Values Added
First Time Atlassian jira Service Management
Atlassian crucible
Atlassian bitbucket Data Center
Atlassian
Atlassian bamboo
Atlassian crowd
Atlassian confluence Data Center
Atlassian fisheye
Atlassian bitbucket Server
Atlassian jira Data Center
References () https://jira.atlassian.com/browse/BAM-26567 - () https://jira.atlassian.com/browse/BAM-26567 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/BSERV-20604 - () https://jira.atlassian.com/browse/BSERV-20604 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/CONFSERVER-104488 - () https://jira.atlassian.com/browse/CONFSERVER-104488 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/CRUC-8741 - () https://jira.atlassian.com/browse/CRUC-8741 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/CWD-6610 - () https://jira.atlassian.com/browse/CWD-6610 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/FE-7583 - () https://jira.atlassian.com/browse/FE-7583 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/JRASERVER-79546 - () https://jira.atlassian.com/browse/JRASERVER-79546 - Issue Tracking, Mitigation, Vendor Advisory
References () https://jira.atlassian.com/browse/JSDSERVER-16809 - () https://jira.atlassian.com/browse/JSDSERVER-16809 - Issue Tracking, Mitigation, Vendor Advisory
References () https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 - () https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 - Third Party Advisory
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 - US Government Resource
CPE cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

15 Oct 2026, 18:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 -

07 Oct 2026, 13:17

Type Values Removed Values Added
References
  • () https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 -

06 Oct 2026, 17:17

Type Values Removed Values Added
Summary (en) h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe.   h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents. (en) This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

06 Oct 2026, 14:17

Type Values Removed Values Added
CWE CWE-552

05 Oct 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-05 22:16

Updated : 2026-10-29 13:17

NVD link : CVE-2026-21589

Mitre link : CVE-2026-21589

CVE.ORG link : CVE-2026-21589

JSON object : View

Products Affected

atlassian

  • bitbucket_data_center
  • jira_service_desk
  • crucible
  • bamboo
  • jira_data_center
  • crowd
  • jira_service_management
  • bitbucket_server
  • fisheye
  • confluence_data_center
CWE
CWE-552

Files or Directories Accessible to External Parties