{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:17:33.833Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "atlassian" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-21589", "url": "https://cveboard.org/i/cve-2026-21589", "urlPt": "https://cveboard.org/pt/i/cve-2026-21589", "json": "https://cveboard.org/i/cve-2026-21589.json", "kind": "vuln", "live": true, "knownExploited": true, "severity": "critical", "title": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability", "summary": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.", "titlePt": "Vulnerabilidade de arquivos ou diretórios acessíveis a partes externas em múltiplos produtos da Atlassian", "summaryPt": "Vários produtos da Atlassian (Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible e Fisheye) contêm uma vulnerabilidade de arquivos ou diretórios acessíveis a partes externas que poderia permitir que um atacante não autenticado acesse arquivos específicos dentro do diretório raiz da aplicação web nas versões afetadas.", "affected": [ { "vendor": "Atlassian", "product": "Bamboo Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 10.2.24 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 12.1.12 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 10.2.24 and later", "Patch version 12.1.12 and later" ] }, { "vendor": "Atlassian", "product": "Bitbucket Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 10.2.8 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 10.5.1 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 9.4.26 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 10.2.8 and later", "Patch version 10.5.1 and later", "Patch version 9.4.26 and later" ] }, { "vendor": "Atlassian", "product": "Confluence Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 10.2.19 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 9.2.26 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 10.2.19 and later", "Patch version 9.2.26 and later" ] }, { "vendor": "Atlassian", "product": "Crowd Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 7.2.4 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 7.1.7 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 7.0.3 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 6.3.7 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 7.2.4 and later", "Patch version 7.1.7 and later", "Patch version 7.0.3 and later", "Patch version 6.3.7 and later" ] }, { "vendor": "Atlassian", "product": "Crucible Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 4.9.15 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 4.9.15 and later" ] }, { "vendor": "Atlassian", "product": "Fisheye Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 4.9.15 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 4.9.15 and later" ] }, { "vendor": "Atlassian", "product": "Jira Service Management Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 11.3.12 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 10.3.26 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 5.12.40 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 11.3.12 and later", "Patch version 10.3.26 and later", "Patch version 5.12.40 and later" ] }, { "vendor": "Atlassian", "product": "Jira Software Data Center", "defaultStatus": "unknown", "versions": [ { "version": "All other versions", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 11.3.12 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 10.3.26 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "Patch version 9.12.40 and later", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "Patch version 11.3.12 and later", "Patch version 10.3.26 and later", "Patch version 9.12.40 and later" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589", "tag": "exploit" } ], "cwes": [ { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" } ], "ssvc": { "exploitation": "active", "automatable": "no", "impact": "total", "at": "2026-10-15T00:00:00.000Z" }, "fix": "listed", "tags": [ "atlassian" ], "cves": [ "CVE-2026-21589" ], "ghsa": null, "cvss": { "score": 9.3, "version": "4.0", "by": "atlassian" }, "epss": { "percentage": 0.12711, "percentile": 0.96263, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Atlassian", "product": "Multiple Products", "kev": { "dateAdded": "2026-10-15", "dueDate": "2026-10-18", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589" } ], "publishedAt": "2026-10-15T00:00:00.000Z", "updatedAt": "2026-10-15T00:00:00.000Z" } ], "tag": { "tag": "atlassian", "name": "Atlassian", "kev": { "name": "Atlassian", "total": 14, "last": "2026-10-15" } } }