Cybersecurity | KEV record | Draft staging record

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an un

Key points

• CVE: CVE-2026-21589
• Added to CISA KEV: 2026-10-15
• Federal remediation due date in the KEV record: 2026-10-18
• Known ransomware campaign use: Unknown

What to do

Apply the vendor fix or mitigation for this CVE, or discontinue use of the affected product where no fix exists. The full required action text is in the primary source record below.

Sources and provenance

Primary source: CISA Known Exploited Vulnerabilities Catalog. Structured record, tier computed in code: auto (reliability 95). This staging page renders a draft record from the Sprint 1 ingest spike; it is not a published story.