CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalogue on 15 October 2026. The flaw affects multiple Atlassian products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. It could let an unauthenticated attacker access specific files within an affected web application’s root directory.
The vulnerability is an external-party file or directory access issue. Its attack vector is access to affected products, and exploitation does not require authentication. The available description does not specify which files may be accessed or further detail the impact. CVE-2026-21589 has a CVSS score of 9.3, rated Critical. Patch status is unknown; organisations should consult Atlassian’s security advisory for vendor guidance.
KEV inclusion indicates that CISA considers the vulnerability actively exploited. The supplied data does not confirm whether ransomware campaigns use it. CISA’s remediation deadline for federal agencies is 18 October 2026.
CISA requires organisations to apply mitigations in accordance with Atlassian’s instructions, follow applicable BOD 26-04 guidance and CISA’s Forensics Triage Requirements, and evaluate each asset’s internet exposure. For cloud services, agencies should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies must meet CISA’s requirements. All organisations should review their exposure and follow the vendor’s guidance.
For full details, see the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-21589) and the [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).