Exploit for CVE-2026-21589

CVE-2026-21589 Atlassian DC Pre-Auth Arbitrary File Read,...

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crow...

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as CVE-2026-21589 CVSS score: 9.3 affects multiple products, including...

VulnCheck KEV: CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

Exploit for CVE-2026-21589

CVE-2026-21589 - Atlassian Data Center Una...

Vulnerability handling in Atlassian Data Center products

The vulnerability exists in several products within the Atlassian Data Center platform, including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability is an Arbitrary File Access issue, allowing unauthorized attackers to access...

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory...

EUVD-2026-92807

h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

An Arbitrary File Access vulnerability exists in multiple Atlassian products, including Bitbucket , Confluence , Jira Software , Jira Service Management , Bamboo , Crowd , Crucible , and Fisheye . This flaw allows an unauthenticated remote attacker to access specific files within the web applicat...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

Atlassian Jira < 9.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JRASERVER-79546)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-79546 advisory. - h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,...

Atlassian Jira Service Management Data Center and Server < 5.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JSDSERVER-16809)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16809 advisory. - This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Da...

PT-2026-106255

Name of the Vulnerable Software and Affected Versions Bitbucket Data Center versions prior to 9.4.26, 10.2.8, or 10.5.1 Confluence Data Center versions prior to 9.2.26 or 10.2.19 Crowd Data Center versions prior to 6.3.7, 7.0.3, 7.1.7, or 7.2.4 Jira Software Data Center versions prior to 9.12.40,...

RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Jira Software Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.12.1, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and...

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data Center

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-12803 was introduced in 9.12.1 and later of Jira Software Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data Center and Server

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-12816 was introduced in 9.12.1 and later of Jira Software Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

DoS (Denial of Service) Apache Tomcat Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability known as CVE-2026-58059 was introduced in 9.12.1 and later of Jira Software Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

BASM (Broken Authentication & Session Management) org.bouncycastle:bcprov-jdk18on Dependency in Jira Software Data Center

This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 9.12.1, 10.0.0, 10.1.1,...