Skip to content
securitytabs

LiveUpdated

Atlassian file-access flaw in eight products added to CISA's exploited list

A flaw in eight Atlassian work-management products, including Jira and Confluence, lets an outsider read files without logging in, and US authorities say it is being used in attacks. Organizations running the self-hosted versions should check Atlassian's advisory and update now.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

This affects self-hosted Atlassian Data Center products, so it matters mainly if your IT provider runs Jira, Confluence or Bitbucket for you. CISA says the flaw is being exploited. [1][2]

What to do

  1. Ask your IT provider whether you use Atlassian Data Center products and whether Atlassian's October 5 advisory has been applied. [1]
  2. If you use Atlassian's hosted service rather than self-hosting, confirm with Atlassian or your provider whether it is affected, since the sources name Data Center products. [1]

Mid-size company

A small IT or security team

What to know

Eight Atlassian products are affected and CISA lists the flaw as exploited, with a federal deadline that has already passed. Exposed files could include any file in the application's web root. [1][2]

What to do

  1. Inventory Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye instances and compare them with Atlassian's advisory. [1]
  2. Apply Atlassian's fixes listed in its advisory, starting with internet-facing instances. [1][2]
  3. Review whether sensitive files such as configuration files sit in the web root of these applications. [1]

Large enterprise

A security operations team

What to know

The flaw needs no login but requires knowing a file's exact path, according to Rapid7. watchTowr has published technical details, and CISA reports active exploitation. [1][3][2]

What to do

  1. Identify all affected Atlassian Data Center and related instances, including those run by business units, and prioritise internet-facing ones for Atlassian's fixes. [1][2]
  2. Hunt in web server logs for unauthenticated requests to unexpected file paths on these applications, going back to before the October 5 advisory. [1][3]
  3. Treat credentials or secrets stored in readable web-root files as potentially exposed on unpatched instances. [1]

Vulnerabilities

What happened

Rapid7 says Atlassian published a security advisory on October 5, 2026 for CVE-2026-21589, a critical flaw that allows access to arbitrary files. Rapid7 lists eight affected products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. [1]

Rapid7 says Atlassian assigned the flaw a CVSS v4 score of 9.3. An unauthenticated remote attacker (one who does not need to log in) who knows a target file's exact name and path can read it within the application's web root, Rapid7 says; the flaw does not provide directory listing or a way to enumerate files. [1]

watchTowr Labs published its own technical write-up on October 6, describing the bug as a pre-authentication arbitrary file read affecting Jira, Confluence and other products. [3]

Exploitation

CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 15, based on evidence of active exploitation. CISA's data sets a federal due date of October 18 and lists known ransomware use as unknown. The sources reviewed do not say who is exploiting the flaw or what files were taken. [2]

Patches and mitigations

The sources reviewed do not list fixed version numbers or workarounds. Atlassian's advisory and its issue tracker entries for each affected product are the authoritative reference for fixes. [1]

Timeline

  1. CISA added the flaw to its KEV catalogue based on evidence of active exploitation. [2]

  2. Rapid7 published an analysis listing eight affected Atlassian products. [1]

  3. watchTowr Labs published a technical analysis of the file-read flaw. [3]

  4. Atlassian published a security advisory for CVE-2026-21589. [1]

Explained

The technology and terms in this story. Learn more

Sources

  1. [1]Rapid7 Blog · Oct 7, 12:11 UTC
    CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian productscontext
  2. [2]CISA Advisories · Oct 15, 12:00 UTC
    CISA Adds One Known Exploited Vulnerability to Catalogcontext
  3. [3]watchTowr Labs · Oct 6, 17:01 UTC
    You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)context