CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Published Oct 5, 2026
·
Updated

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Other sources

Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.

— NVD

Affected Software

30 affected components
Atlassian Bitbucket Data Center>=4.6.0
Atlassian Confluence Data Center>=5.10.0
Atlassian Crowd Data Center>=2.11.0
Atlassian Jira Software Data Center>=7.1.0
Atlassian Jira Service Management Data Center>=3.1.0
Atlassian Bamboo Data Center>=7.0.1
Atlassian Crucible
Atlassian Fisheye
Atlassian Multiple Products
Atlassian Bitbucket Data Center>=7.17.0<9.4.26
Atlassian Bitbucket Data Center>=9.5.0<10.2.8
Atlassian Bitbucket Data Center>=10.3.0<10.5.1
Atlassian Bitbucket Server>=4.6.0<=8.14.6
Atlassian Confluence Data Center>=5.10.0<9.2.26
Atlassian Confluence Data Center>=9.3.0<10.2.19
Atlassian crowd>=2.11.0<6.3.7
Atlassian crowd>=7.0.0<7.0.3
Atlassian crowd>=7.1.0<7.1.7
Atlassian crowd>=7.2.0<7.2.4
Atlassian Jira Data Center>=7.1.0<9.12.40
Atlassian Jira Data Center>=9.13.0<10.3.26
Atlassian Jira Data Center>=10.4.0<11.3.12
Atlassian Jira Service Desk>=3.1.0<=4.13.27
Atlassian Jira Service Management>=4.14.0<5.12.40
Atlassian Jira Service Management>=5.13.0<10.3.26
Atlassian Jira Service Management>=10.4.0<11.3.12
Atlassian Bamboo>=7.0.1<10.2.24
Atlassian Bamboo>=11.0.0<12.1.12
Atlassian Crucible<4.9.15
Atlassian Fisheye<4.9.15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Bitbucket Data Center to a version that resolves this vulnerability.

    Fixed in 9.4.26
  2. Upgrade

    Upgrade Bitbucket Data Center to a version that resolves this vulnerability.

    Fixed in 10.2.8
  3. Upgrade

    Upgrade Bitbucket Data Center to a version that resolves this vulnerability.

    Fixed in 10.5.1
  4. Upgrade

    Upgrade Confluence Data Center to a version that resolves this vulnerability.

    Fixed in 9.2.26
  5. Upgrade

    Upgrade Confluence Data Center to a version that resolves this vulnerability.

    Fixed in 10.2.19
  6. Upgrade

    Upgrade Crowd Data Center to a version that resolves this vulnerability.

    Fixed in 6.3.7
  7. Upgrade

    Upgrade Crowd Data Center to a version that resolves this vulnerability.

    Fixed in 7.0.3
  8. Upgrade

    Upgrade Crowd Data Center to a version that resolves this vulnerability.

    Fixed in 7.1.7
  9. Upgrade

    Upgrade Crowd Data Center to a version that resolves this vulnerability.

    Fixed in 7.2.4
  10. Upgrade

    Upgrade Jira Software Data Center to a version that resolves this vulnerability.

    Fixed in 9.12.40
  11. Upgrade

    Upgrade Jira Software Data Center to a version that resolves this vulnerability.

    Fixed in 10.3.26
  12. Upgrade

    Upgrade Jira Software Data Center to a version that resolves this vulnerability.

    Fixed in 11.3.12
  13. Upgrade

    Upgrade Jira Service Management Data Center to a version that resolves this vulnerability.

    Fixed in 5.12.40
  14. Upgrade

    Upgrade Jira Service Management Data Center to a version that resolves this vulnerability.

    Fixed in 10.3.26
  15. Upgrade

    Upgrade Jira Service Management Data Center to a version that resolves this vulnerability.

    Fixed in 11.3.12
  16. Upgrade

    Upgrade Bamboo Data Center to a version that resolves this vulnerability.

    Fixed in 10.2.24
  17. Upgrade

    Upgrade Bamboo Data Center to a version that resolves this vulnerability.

    Fixed in 12.1.12
  18. Upgrade

    Upgrade Crucible to a version that resolves this vulnerability.

    Fixed in 4.9.15
  19. Upgrade

    Upgrade Fisheye to a version that resolves this vulnerability.

    Fixed in 4.9.15

Event History

Oct 5, 2026
CVE Published
via MITRE·09:30 PM
Data Sourced
via MITRE·09:30 PM
DescriptionWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeaknessAffected Software
Oct 6, 2026
Exploit Published
via GitHub·10:40 AM
Oct 15, 2026
Data Sourced
via CISA·12:00 AM
RemedyDescriptionWeaknessAffected Software

Frequently Asked Questions

1

Which documented releases should be used to remediate affected Bitbucket, Confluence, and Crowd deployments?

Bitbucket Data Center is fixed in 9.4.26, 10.2.8, and 10.5.1. Confluence Data Center is fixed in 9.2.26 and 10.2.19. Crowd Data Center is fixed in 6.3.7, 7.0.3, 7.1.1, and 7.2.4.

2

How far back does the documented exposure extend for these products?

The issue was introduced in Bitbucket Data Center 4.6.0 or later, Confluence Data Center 5.10.0 or later, Crowd Data Center 2.11.0 or later, and Jira Software Data Center 7.1.0 or later. The supplied information does not provide the corresponding introduction versions for the other listed products.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203