CISA adds Atlassian flaw to the KEV catalog (CVE-2026-21589)
CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on October 15, based on evidence of active exploitation, with a federal remediation deadline of October 18. The flaw is a critical 9.3 arbitrary file access issue (CWE-552) in eight Atlassian Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows a target file name and path can access specific files in the web application root.
Atlassian published fixed versions for every affected product on October 5, and Atlassian Cloud versions were already patched. watchTowr notes that deployments storing sensitive files in the web application root carry added risk, and advises prioritizing internet facing instances and checking logs for signs of compromise before and after patching.