Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
High CVSS 7.5 Listed in CISA KEV
Summary
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- Atlassian:Multiple Products
- :
- :
- :
- :
- :
- :
- :
- :
Sources
- CISA KEV DATABASE
- NVD DATABASE
Original Links
- https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-21589 reference
- https://jira.atlassian.com/browse/BAM-26567 Issue Tracking
- https://jira.atlassian.com/browse/BSERV-20604 Issue Tracking
- https://jira.atlassian.com/browse/CONFSERVER-104488 Issue Tracking
- https://jira.atlassian.com/browse/CRUC-8741 Issue Tracking
- https://jira.atlassian.com/browse/CWD-6610 Issue Tracking
- https://jira.atlassian.com/browse/FE-7583 Issue Tracking
- https://jira.atlassian.com/browse/JRASERVER-79546 Issue Tracking
- https://jira.atlassian.com/browse/JSDSERVER-16809 Issue Tracking
- https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589 US Government Resource
Timeline
- kev_ingest CISA KEV
- nvd_ingest NVD