Zero Radar
← feed
CriticalVulnerabilityCVE-2026-21589updated 26 Oct 2026, 10:14 UTC

Atlassian Data Center products can expose files to outside attackers

Attackers who don't have a login can read certain files on your Atlassian server, and some of those files may hold secrets. Attackers are already using this flaw.

Exploited (CISA KEV, NVD)Fix availableOfficial, 3 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 15 Oct 2026
Fix available?YesBitbucket 9.4.26, 10.2.8, 10.5.1; Confluence 9.2.26, 10.2.19; Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4; Jira Software 9.12.40, 10.3.26, 11.3.12; Jira Service Management 5.12.40, 10.3.26, 11.3.12; Bamboo 10.2.24, 12.1.12; Crucible and Fisheye 4.9.15. · since 25 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestNo login needed, targets a known file path
  2. 2Request reaches serverInternet-facing Atlassian instance
  3. 3Server returns fileFiles in web root are served without checks
  4. 4Sensitive data exposedConfig or secret files may contain credentials
  5. ResultAttacker reads sensitive files from the server

What happened

An arbitrary file access flaw in multiple Atlassian Data Center products lets an unauthenticated remote attacker read specific files inside the web application root directory.

Why it is dangerous: Exposed configuration or sensitive files can reveal credentials and internal data, and attackers already exploit this, so internet-facing servers are at highest risk.

Are you affected?

You are affected if you run an affected Atlassian Data Center product (Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible or Fisheye) at a vulnerable version.

Bitbucket Data Center >= 4.6.0 (before 9.4.26, 10.2.8, 10.5.1); Confluence Data Center >= 5.10.0 (before 9.2.26, 10.2.19); Crowd Data Center >= 2.11.0 (before 6.3.7, 7.0.3, 7.1.7, 7.2.4); Jira Software Data Center >= 7.1.0 (before 9.12.40, 10.3.26, 11.3.12); Jira Service Management Data Center >= 3.1.0 (before 5.12.40, 10.3.26, 11.3.12); Bamboo Data Center >= 7.0.1 (before 10.2.24, 12.1.12); Crucible and Fisheye (before 4.9.15).

What to do

  1. Upgrade each affected Atlassian Data Center product to a fixed version, starting with internet-facing instances
  2. Check web server and access logs for requests to unusual or sensitive file paths
  3. Apply CISA BOD 26-04 guidance and review systems for forensic signs of compromise

Timeline

  1. 5 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 15 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 15:20 UTC
    CERT-EU reported on it · CERT-EU
  4. 25 Oct 2026, 15:20 UTC
    Fix: Upgrade to a fixed version as published in Atlassian's security advisory (version numbers not stated in the material); vendor mitigations apply where no patch is available
  5. 26 Oct 2026, 10:14 UTC
    NVD reported on it · NVD

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-21589 · ZR-f2ec234b
CVSS
9.3 / 10
EPSS
99% chance of exploitation within 30 days
Disclosed
5 Oct 2026, 22:16 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 10:14 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Atlassian Data Center products can expose files to outside attackers · Zero Radar