{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:32.877Z","products":["atlassian"],"actNowTotal":1,"results":[{"query":"atlassian","matched":1,"actNow":1,"events":[{"id":"kev-2026-10-15-atlassian-multiple-products","url":"https://securitythreatpulse.com/events/kev-2026-10-15-atlassian-multiple-products","title":"Several Atlassian products: security flaw used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 36 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (9.3). The exploit prediction score is 100%.","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public.","9 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-21589"],"vendor":"Atlassian","product":"Multiple Products","affectedProducts":[{"kind":"direct","slug":"atlassian/multipleproducts","vendor":"Atlassian","product":"Multiple Products","evidence":["kev"],"vendorKey":"atlassian","productKey":"multipleproducts"},{"kind":"direct","slug":"atlassian/bamboodatacenter","vendor":"Atlassian","product":"Bamboo Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"bamboodatacenter"},{"kind":"direct","slug":"atlassian/bitbucketdatacenter","vendor":"Atlassian","product":"Bitbucket Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"bitbucketdatacenter"},{"kind":"direct","slug":"atlassian/confluencedatacenter","vendor":"Atlassian","product":"Confluence Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"confluencedatacenter"},{"kind":"direct","slug":"atlassian/crowddatacenter","vendor":"Atlassian","product":"Crowd Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"crowddatacenter"},{"kind":"direct","slug":"atlassian/crucibledatacenter","vendor":"Atlassian","product":"Crucible Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"crucibledatacenter"},{"kind":"direct","slug":"atlassian/fisheyedatacenter","vendor":"Atlassian","product":"Fisheye Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"fisheyedatacenter"},{"kind":"direct","slug":"atlassian/jiraservicemanagementdatacenter","vendor":"Atlassian","product":"Jira Service Management Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"jiraservicemanagementdatacenter"},{"kind":"direct","slug":"atlassian/jirasoftwaredatacenter","vendor":"Atlassian","product":"Jira Software Data Center","evidence":["cpe"],"vendorKey":"atlassian","productKey":"jirasoftwaredatacenter"}],"category":{"id":"collaboration","label":"Documents and collaboration","why":"It holds shared documents and internal pages.","doThis":"Patch it, or ask your provider whether they have."},"summary":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in…","cvss":9.3,"epss":0.99664,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-15","kevDueDate":"2026-10-18","firstSeenAt":"2026-10-15T00:00:00.000Z","updatedAt":"2026-11-10T21:30:27.547Z","newestEvidenceAt":"2026-11-07T05:13:29.454Z"}]}]}