THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an Atlassian flaw, CVE-2026-21589, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is described as a critical arbitrary file access flaw in Atlassian Data Center products, with a CVSS score of 9.3. It could allow unauthenticated attackers to read specific files within the web application root, given knowledge of the exact file name and path.
Affected Atlassian products include Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Centre, Crowd Data Centre, Crucible, and Fisheye. WatchTowr Labs and Previdian telemetry document early exploitation activity, with 15 exploitation attempts observed from three IPs in Japan and the United States, and the issue being demonstrated in honeypot environments.
Exploitation hinges on a path traversal flaw where double-colon sequences (::) can act as path separators, enabling access to files such as crowd[.]properties and potentially exposing application credentials.
Atlassian has published fixed versions for each product, with the list including Bitbucket Data Centre 9.4.26, 10.2.8, 10.5.1; Confluence Data Centre 9.2.26, 10.2.19; Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12; Jira Software Data Center 9.12.40, 10.3.26, 11.3.12; Bamboo Data Center 10.2.24, 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4; as well as Crucible and Fisheye (versions 4.9.15). watchTowr has released a free tool to help assess vulnerability.
Federal agencies are required to fix the flaw by 18 October 2026 under BOD 22-01, with private organisations urged to update the KEV catalog entries and address affected systems.