--- title: "CVE-2026-21589: Atlassian Data Center - Arbitrary File Access" description: "Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center versions contain an arbitrary file access vulnerability caused by improper access control in the web application root directory, letting unauthenticated attackers access specific files with prior knowledge of exact file names and paths, exploit requires prior knowledge of target file path." url: https://panop.io/threat-heartbeat/CVE-2026-21589/ --- # CVE-2026-21589 Atlassian Data Center - Arbitrary File Access Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center versions contain an arbitrary file access vulnerability caused by improper access control in the web application root directory, letting unauthenticated attackers access specific files with prior knowledge of exact file names and paths, exploit requires prior knowledge of target file path. CVSS base score 9.3 /10 Critical CISA KEV Exploited in the wild Public exploit Proof of concept available Authentication Not required EPSS 2.78% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-21589) ## Details Type Arbitrary File Access Impact Information Disclosure, File System Read CVSS vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Published 5 October 2026 Updated 15 October 2026 Weakness [CWE-552](https://cwe.mitre.org/data/definitions/552.html) ## Vendor fix Upgrade to fixed versions: Bitbucket 9.4.26, 10.2.8, 10.5.1; Confluence 9.2.26, 10.2.19; Crowd 6.3.7, 7.0.3, 7.1.1, 7.2.4; Jira Software 9.12.40, 10.3.26, 11.3.12; Jira Service Management 5.12.40, 10.3.26, 11.3.12; Bamboo 10.2.24, 12.1.12; Crucible 4.9.15; Fisheye 4.9.15 or later. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-21589](https://nvd.nist.gov/vuln/detail/CVE-2026-21589) - [https://previdian.com/CVE-2026-21589](https://previdian.com/CVE-2026-21589) - [https://jira.atlassian.com/browse/BAM-26567](https://jira.atlassian.com/browse/BAM-26567) - [https://jira.atlassian.com/browse/BSERV-20604](https://jira.atlassian.com/browse/BSERV-20604) - [https://jira.atlassian.com/browse/CONFSERVER-104488](https://jira.atlassian.com/browse/CONFSERVER-104488) - [https://jira.atlassian.com/browse/CWD-6610](https://jira.atlassian.com/browse/CWD-6610) - [https://jira.atlassian.com/browse/FE-7583](https://jira.atlassian.com/browse/FE-7583) - [https://jira.atlassian.com/browse/CRUC-8741](https://jira.atlassian.com/browse/CRUC-8741) - [https://jira.atlassian.com/browse/JRASERVER-79546](https://jira.atlassian.com/browse/JRASERVER-79546) - [https://jira.atlassian.com/browse/JSDSERVER-16809](https://jira.atlassian.com/browse/JSDSERVER-16809) - [https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589](https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589) - [https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/](https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)