---
title: Atlassian CVE-2026-21589 added to CISA KEV: unauthenticated file read in Jira, Confluence, Bitbucket, Bamboo, Crowd and Fisheye/Crucible Data Center | ctxsec
url: https://ctxsec.com/items/atlassian-cve-2026-21589-kev
description: ""
status: "confirmed (CISA KEV); exploited, last updated Oct 18, 2026"
published: 2026-10-15
updated: 2026-10-18
---

> 

[← Cybersecurity News](/news) · [markdown](/items/atlassian-cve-2026-21589-kev.md)

confirmed (CISA KEV); exploited

2026-10-15 · updated

Oct 18, 2026

### Atlassian CVE-2026-21589 added to CISA KEV: unauthenticated file read in Jira, Confluence, Bitbucket, Bamboo, Crowd and Fisheye/Crucible Data Center

CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog on Oct 15 (catalogVersion 2026.10.15) with a short federal due date of **Oct 18** and its forensic-triage flag set under BOD 26-04. Atlassian's Oct 5 advisory rates it Critical (CVSS 4.0 9.3): an unauthenticated attacker can read specific files inside the web application root of **every** version of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. The attacker must know the exact file path (no directory listing), but Atlassian warns some configurations hold sensitive files there. Fixed versions: Bitbucket 9.4.26 / 10.2.8 / 10.5.1; Confluence 9.2.26 / 10.2.19; Jira Software 9.12.40 / 10.3.26 / 11.3.12; JSM 5.12.40 / 10.3.26 / 11.3.12; Bamboo 10.2.24 / 12.1.12; Crowd 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Crucible and Fisheye 4.9.15. If you can't patch, take the instance off the internet or apply Atlassian's WAF / Tomcat RewriteValve / Bitbucket urlrewrite rule that blocks `..` next to `/`, `\` or `::` (including URL-encoded forms). Atlassian Cloud is already patched and Atlassian found no Cloud exploitation. watchTowr published a technical analysis on Oct 6. **Update Oct 18:** the CVE record itself was moved to REJECTED on Oct 16 at 20:39 UTC (4:39 PM ET) with only the boilerplate note that its publication 'may have been a false positive or a mistake'. As of Oct 18 the KEV entry is still listed with the Oct 18 due date, and Atlassian's advisory still shows CVE-2026-21589 with the same fixed versions. Keep patching on the vendor guidance; don't let scanners that drop rejected CVEs hide unpatched instances.

Sources: [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Atlassian advisory: CVE-2026-21589](https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html) · [watchTowr Labs analysis](https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/) · [NVD CVE-2026-21589](https://nvd.nist.gov/vuln/detail/CVE-2026-21589) · [CVE record (REJECTED)](https://www.cve.org/CVERecord?id=CVE-2026-21589)