CVE-2026-21589

CRITICAL9.3

CISA KEVPublic PoCNews

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

CVSS breakdown

CVSS 4.0

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality (Vulnerable System)

High

Integrity (Vulnerable System)

None

Availability (Vulnerable System)

None

Confidentiality (Subsequent System)

High

Integrity (Subsequent System)

High

Availability (Subsequent System)

High

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected products

Atlassian / Bamboo7.0.1 – 10.2.24
Atlassian / Bamboo Data CenterPatch version 10.2.24 and later – Patch version 10.2.24 and later
Atlassian / Bamboo Data CenterPatch version 10.2.4 and later – Patch version 10.2.4 and later
Atlassian / Bamboo Data CenterPatch version 12.1.12 and later – Patch version 12.1.12 and later
Atlassian / Bamboo Data CenterAll other versions – All other versions
Atlassian / Bamboo ServerAll versions – All versions
Atlassian / Bitbucket Data Center7.17.0 – 9.4.26
Atlassian / Bitbucket Data CenterPatch version 10.5.1 and later – Patch version 10.5.1 and later
Atlassian / Bitbucket Data CenterPatch version 9.4.26 and later – Patch version 9.4.26 and later
Atlassian / Bitbucket Data CenterAll other versions – All other versions
Atlassian / Bitbucket Data CenterPatch version 10.2.8 and later – Patch version 10.2.8 and later
Atlassian / Bitbucket ServerAll versions – All versions
Atlassian / Bitbucket Server4.6.0 – 8.14.6
Atlassian / Confluence Data CenterPatch version 10.2.19 and later – Patch version 10.2.19 and later
Atlassian / Confluence Data CenterAll other versions – All other versions
Atlassian / Confluence Data CenterPatch version 9.2.26 and later – Patch version 9.2.26 and later
Atlassian / Confluence Data Center5.10.0 – 9.2.26
Atlassian / Confluence ServerAll versions – All versions
Atlassian / Crowd2.11.0 – 6.3.7
Atlassian / Crowd Data CenterPatch version 7.1.7 and later – Patch version 7.1.7 and later
Atlassian / Crowd Data CenterAll other versions – All other versions
Atlassian / Crowd Data CenterPatch version 7.2.4 and later – Patch version 7.2.4 and later
Atlassian / Crowd Data CenterPatch version 7.1.1 and later – Patch version 7.1.1 and later
Atlassian / Crowd Data CenterPatch version 7.0.3 and later – Patch version 7.0.3 and later
Atlassian / Crowd Data CenterPatch version 6.3.7 and later – Patch version 6.3.7 and later
Atlassian / Crowd ServerAll versions – All versions
Atlassian / Crucible4.9.15
Atlassian / Crucible Data CenterPatch version 4.9.15 and later – Patch version 4.9.15 and later
Atlassian / Crucible Data CenterAll other versions – All other versions
Atlassian / Crucible ServerPatch version 4.9.15 and later – Patch version 4.9.15 and later
Atlassian / Crucible ServerAll other versions – All other versions
Atlassian / Fisheye4.9.15
Atlassian / Fisheye Data CenterPatch version 4.9.15 and later – Patch version 4.9.15 and later
Atlassian / Fisheye Data CenterAll other versions – All other versions
Atlassian / Fisheye ServerAll other versions – All other versions
Atlassian / Fisheye ServerPatch version 4.9.15 and later – Patch version 4.9.15 and later
Atlassian / Jira Data Center7.1.0 – 9.12.40
Atlassian / jira_service_desk3.1.0 – 4.13.27
Atlassian / jira_service_management4.14.0 – 5.12.40
Atlassian / Jira Service Management Data CenterPatch version 10.3.26 and later – Patch version 10.3.26 and later
Atlassian / Jira Service Management Data CenterPatch version 5.12.40 and later – Patch version 5.12.40 and later
Atlassian / Jira Service Management Data CenterPatch version 11.3.12 and later – Patch version 11.3.12 and later
Atlassian / Jira Service Management Data CenterAll other versions – All other versions
Atlassian / Jira Service Management ServerPatch version 5.12.40 and later – Patch version 5.12.40 and later
Atlassian / Jira Service Management ServerAll other versions – All other versions
Atlassian / Jira Software Data CenterPatch version 11.3.12 and later – Patch version 11.3.12 and later
Atlassian / Jira Software Data CenterPatch version 10.3.26 and later – Patch version 10.3.26 and later
Atlassian / Jira Software Data CenterAll other versions – All other versions
Atlassian / Jira Software Data CenterPatch version 9.12.40 and later – Patch version 9.12.40 and later
Atlassian / Jira Software ServerAll other versions – All other versions
Atlassian / Jira Software ServerPatch version 9.12.40 and later – Patch version 9.12.40 and later

Exploits & proofs of concept

nucleiAtlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Readby Kazgangap,DhiyaneshDk,watchtowr

News coverage

Hackers exploit critical Atlassian flaw after public PoC releaseBleepingComputer · 20d ago
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public DetailsThe Hacker News · 20d ago
Atlassian warns of critical file-access flaw in Jira, ConfluenceBleepingComputer · 20d ago
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 ProductsThe Hacker News · 21d ago

References

Updated 22m ago · 8 sources