SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
9 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-21589 · CVSS 9.3

Several Atlassian products: security flaw used in attacks

AFFECTSAtlassian Multiple ProductsAtlassian Bamboo Data CenterAtlassian Bitbucket Data CenterAtlassian Confluence Data CenterAtlassian Crowd Data CenterAtlassian Crucible Data CenterAtlassian Fisheye Data CenterAtlassian Jira Service Management Data CenterAtlassian Jira Software Data Center

OFFICIAL NAME: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

WHAT IT IS · DOCUMENTS AND COLLABORATIONIt holds shared documents and internal pages.

DO THIS FIRSTPatch it, or ask your provider whether they have. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in…

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 36 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (9.3). The exploit prediction score is 100%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. Ready-made attack tools are public. 9 products are affected.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    CVE-2026-21589 discussed publicly (CIRCL sighting). CVE-2026-21589 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Attack attempts on CVE-2026-21589 seen by honeypots (Shadowserver via CIRCL). Attack attempts on CVE-2026-21589 seen by honeypots (Shadowserver via CIRCL).

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. CISA Vulnrichment marks CVE-2026-21589 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-21589 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 10 days after disclosure. CISA listed it 10 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 18, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. OCT 5, 2026
    CISA Vulnrichment marks CVE-2026-21589 as actively exploited
  2. OCT 6, 2026
    13 public GitHub repositories claim a proof of concept for CVE-2026-21589
  3. OCT 6, 2026
    Vulnerability CVE-2026-21589 confirmed by a researcher (CIRCL sighting)
  4. Attack activity. OCT 14, 2026
    Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
  5. OCT 15, 2026
    Atlassian security advisory (AV26-1002) - Update 2
  6. Attack activity. OCT 21, 2026
    Attack attempts on CVE-2026-21589 seen by honeypots (Shadowserver via CIRCL) (2 reports, latest OCT 22)
  7. NOV 4, 2026
    CVE-2026-21589 discussed publicly (CIRCL sighting) (5 reports, latest NOV 6)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read, OCT 24
  2. [2] CIRCL Vulnerability-Lookup sightings: CVE-2026-21589 discussed publicly (CIRCL sighting), NOV 6
  3. [3] CIRCL Vulnerability-Lookup sightings: Attack attempts on CVE-2026-21589 seen by honeypots (Shadowserver via CIRCL), OCT 22
  4. [4] Canadian Centre for Cyber Security: Atlassian security advisory (AV26-1002) - Update 2, OCT 15
  5. [5] CISA Known Exploited Vulnerabilities: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability, OCT 14
  6. [6] CIRCL Vulnerability-Lookup sightings: Vulnerability CVE-2026-21589 confirmed by a researcher (CIRCL sighting), OCT 6
  7. [7] PoC-in-GitHub: 13 public GitHub repositories claim a proof of concept for CVE-2026-21589, OCT 6
  8. [8] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-21589 as actively exploited, OCT 5
  9. [9] CIRCL Vulnerability-Lookup sightings: 4 more reports