CVE-2026-21589

exploited in the wild☆ pin

CVSS

9.3

Reports

First seen

Oct 6, 2026

Last seen

Oct 15, 2026

Affected product

Atlassian Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Fisheye

Associated actors

CyberXero ×1 DataSuckers ×1 UAC-0099 ×1 Xuanye ×1

Recent reports

High

CISA Adds CVE-2026-21589 Atlassian Vulnerability to Known Exploited Vulnerabilities Catalog

CISA AdvisoriesOct 15, 2026 High

Atlassian Data Center Arbitrary File Access Flaw (CVE-2026-21589) Exploited Within Hours

The Hacker NewsOct 7, 2026 Critical

CVE-2026-21589: Critical Arbitrary File Access in Multiple Atlassian Products

CERT-EU AdvisoriesOct 7, 2026 High

Atlassian warns of critical file-access flaw in Jira, Confluence, and other Data Center products

Bleeping ComputerOct 6, 2026 High

Critical Path Traversal in Atlassian Data Center Products Enables Unauthenticated File Read

The Hacker NewsOct 6, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.