Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Atlassian products expose internal files to outsiders

CVE-2026-21589 · published 13 days ago · actively exploited
Summary

Several Atlassian tools, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye, allow anyone on the internet to view files that should be private. This can reveal sensitive configuration or code details. Apply the vendor’s recommended updates or configuration changes to block public access to those directories.

What to do
  • Update atlassian crucible to version 4.9.15 or later.
  • Update atlassian fisheye to version 4.9.15 or later.
Affected software
VendorProductAffected versions
atlassian multiple products All versions
atlassian bamboo data center All other versions
atlassian bamboo server All versions
atlassian bitbucket data center All other versions
atlassian bitbucket server All versions
atlassian confluence data center All other versions
atlassian confluence server All versions
atlassian crowd data center All other versions
atlassian crowd server All versions
atlassian crucible data center All other versions
atlassian crucible server All other versions
atlassian fisheye data center All other versions
atlassian fisheye server All other versions
atlassian jira service management data center All other versions
atlassian jira service management server All other versions
atlassian jira software data center All other versions
atlassian jira software server All other versions
atlassian bitbucket_data_center >= 7.17.0, < 9.4.26
>= 9.5.0, < 10.2.8
>= 10.3.0, < 10.5.1
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
atlassian bitbucket_server >= 4.6.0, <= 8.14.6
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
atlassian confluence_data_center >= 5.10.0, < 9.2.26
>= 9.3.0, < 10.2.19
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
atlassian crowd >= 2.11.0, < 6.3.7
>= 7.0.0, < 7.0.3
>= 7.1.0, < 7.1.7
>= 7.2.0, < 7.2.4
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
atlassian jira_data_center >= 7.1.0, < 9.12.40
>= 9.13.0, < 10.3.26
>= 10.4.0, < 11.3.12
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
atlassian jira_service_management >= 3.1.0, < 5.12.40
>= 5.13.0, < 10.3.26
>= 10.4.0, < 11.3.12
>= 4.14.0, < 5.12.40
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
atlassian bamboo >= 7.0.1, < 10.2.24
>= 11.0.0, < 12.1.12
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
atlassian crucible < 4.9.15
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
atlassian fisheye < 4.9.15
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
atlassian jira_service_desk >= 3.1.0, <= 4.13.27
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
Original advisory text
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
References
Fix within
Internet-facing 3 days
and check for signs of compromise
Internal 14 days
  • Known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
13% chance of attack within 30 days
Type
CWE-552Files or Directories Accessible to External Parties
Timeline
Published5 Oct 2026
Updated16 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-21589 · NVD
CVE-2026-21589 · MITRE
CVE-2026-21589 · CISA KEV
Track software like this
Free during beta