Read the docs
TI-2026-67904 Aliases CVE-2026-21589GHSA-gr66-x5pq-8g2g

Arbitrary file access in Atlassian Data Center products

Priority CRITICAL 99Exploited in the wildCWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-552.

Summary

An arbitrary file access flaw (CWE-552) in Atlassian Bitbucket, Confluence, Crowd, Jira Software, Jira Service Management, Bamboo, Crucible and Fisheye Data Center lets an unauthenticated remote attacker access specific files within the web application root directory. Exploitation requires knowing the exact name and path of the target file, because directory contents cannot be listed. Some configurations contain sensitive files, which makes the flaw highly severe. CISA lists the flaw in its Known Exploited Vulnerabilities catalog, added 2026-10-15.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-15CISA due date 2026-10-18
EPSS 0.99664 99th percentileScored 2026-11-07
Fix Fixed Bamboo Data Center (Atlassian): Patch version 10.2.24 and later, Patch version 12.1.12 and laterBitbucket Data Center (Atlassian): Patch version 10.2.8 and later, Patch version 10.5.1 and later, Patch version 9.4.26 and later+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianBamboo Data CenterAll other versionsPatch version 10.2.24 and later, Patch version 12.1.12 and laterPatch availableCNA
AtlassianBitbucket Data CenterAll other versionsPatch version 10.2.8 and later, Patch version 10.5.1 and later, Patch version 9.4.26 and laterPatch availableCNA
AtlassianConfluence Data CenterAll other versionsPatch version 10.2.19 and later, Patch version 9.2.26 and laterPatch availableCNA
AtlassianCrowd Data CenterAll other versionsPatch version 7.2.4 and later, Patch version 7.1.7 and later, Patch version 7.0.3 and later, Patch version 6.3.7 and laterPatch availableCNA
AtlassianCrucible Data CenterAll other versionsPatch version 4.9.15 and laterPatch availableCNA
AtlassianFisheye Data CenterAll other versionsPatch version 4.9.15 and laterPatch availableCNA
AtlassianJira Service Management Data CenterAll other versionsPatch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 5.12.40 and laterPatch availableCNA
AtlassianJira Software Data CenterAll other versionsPatch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 9.12.40 and laterPatch availableCNA
  • Bamboo Data Center VendorAtlassian Affected All other versions Fixed in Patch version 10.2.24 and later, Patch version 12.1.12 and later Patch available CNA
  • Bitbucket Data Center VendorAtlassian Affected All other versions Fixed in Patch version 10.2.8 and later, Patch version 10.5.1 and later, Patch version 9.4.26 and later Patch available CNA
  • Confluence Data Center VendorAtlassian Affected All other versions Fixed in Patch version 10.2.19 and later, Patch version 9.2.26 and later Patch available CNA
  • Crowd Data Center VendorAtlassian Affected All other versions Fixed in Patch version 7.2.4 and later, Patch version 7.1.7 and later, Patch version 7.0.3 and later, Patch version 6.3.7 and later Patch available CNA
  • Crucible Data Center VendorAtlassian Affected All other versions Fixed in Patch version 4.9.15 and later Patch available CNA
  • Fisheye Data Center VendorAtlassian Affected All other versions Fixed in Patch version 4.9.15 and later Patch available CNA
  • Jira Service Management Data Center VendorAtlassian Affected All other versions Fixed in Patch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 5.12.40 and later Patch available CNA
  • Jira Software Data Center VendorAtlassian Affected All other versions Fixed in Patch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 9.12.40 and later Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*7.17.0 to before 9.4.26; 9.5.0 to before 10.2.8; 10.3.0 to before 10.5.1VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*4.6.0 – 8.14.6VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*5.10.0 to before 9.2.26; 9.3.0 to before 10.2.19VulnerableAtlassian
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*2.11.0 to before 6.3.7; 7.0.0 to before 7.0.3; 7.1.0 to before 7.1.7; 7.2.0 to before 7.2.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*7.1.0 to before 9.12.40; 9.13.0 to before 10.3.26; 10.4.0 to before 11.3.12VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*3.1.0 – 4.13.27VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*4.14.0 to before 5.12.40; 5.13.0 to before 10.3.26; 10.4.0 to before 11.3.12VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*7.0.1 to before 10.2.24; 11.0.0 to before 12.1.12VulnerableAtlassian
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*before 4.9.15VulnerableAtlassian
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*before 4.9.15VulnerableAtlassian
  • cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:* Versions 7.17.0 to before 9.4.26; 9.5.0 to before 10.2.8; 10.3.0 to before 10.5.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:* Versions 4.6.0 – 8.14.6 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions 5.10.0 to before 9.2.26; 9.3.0 to before 10.2.19 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions 2.11.0 to before 6.3.7; 7.0.0 to before 7.0.3; 7.1.0 to before 7.1.7; 7.2.0 to before 7.2.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 7.1.0 to before 9.12.40; 9.13.0 to before 10.3.26; 10.4.0 to before 11.3.12 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions 3.1.0 – 4.13.27 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.14.0 to before 5.12.40; 5.13.0 to before 10.3.26; 10.4.0 to before 11.3.12 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:* Versions 7.0.1 to before 10.2.24; 11.0.0 to before 12.1.12 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:* Versions before 4.9.15 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:* Versions before 4.9.15 Vulnerable ·Atlassian

Remediation

Upgrade Bamboo Data Center to 10.2.24 or 12.1.12, Bitbucket Data Center to 9.4.26, 10.2.8 or 10.5.1, Confluence Data Center to 9.2.26 or 10.2.19, Crowd Data Center to 6.3.7, 7.0.3, 7.1.7 or 7.2.4, Crucible and Fisheye to 4.9.15, Jira Service Management Data Center to 5.12.40, 10.3.26 or 11.3.12, and Jira Software Data Center to 9.12.40, 10.3.26 or 11.3.12. CISA set the due date for remediation to 2026-10-18.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Bamboo Data Center (Atlassian) Fixed in Patch version 10.2.24 and later, Patch version 12.1.12 and later
  • Fix · CNA Bitbucket Data Center (Atlassian) Fixed in Patch version 10.2.8 and later, Patch version 10.5.1 and later, Patch version 9.4.26 and later
  • Fix · CNA Confluence Data Center (Atlassian) Fixed in Patch version 10.2.19 and later, Patch version 9.2.26 and later
  • Fix · CNA Crowd Data Center (Atlassian) Fixed in Patch version 7.2.4 and later, Patch version 7.1.7 and later, Patch version 7.0.3 and later, Patch version 6.3.7 and later
  • Fix · CNA Crucible Data Center (Atlassian) Fixed in Patch version 4.9.15 and later
  • Fix · CNA Fisheye Data Center (Atlassian) Fixed in Patch version 4.9.15 and later
  • Fix · CNA Jira Service Management Data Center (Atlassian) Fixed in Patch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 5.12.40 and later
  • Fix · CNA Jira Software Data Center (Atlassian) Fixed in Patch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 9.12.40 and later

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-21589
  2. 2026-10-06 Alias added: GHSA-gr66-x5pq-8g2g
  3. 2026-10-06 Title updated · CNA
  4. 2026-10-06 Weakness changed · CISA ADP
  5. 2026-10-06 CISA SSVC decision points changed
  6. 2026-10-06 Fix available: Atlassian/Bamboo Data Center@Patch version 10.2.24 and later, Atlassian/Crowd Data Center@Patch version 7.1.7 and later · CNA
  7. 2026-10-06 CISA SSVC decision points changed
  8. 2026-10-06 Priority changed: MEDIUM → LOW
  9. 2026-10-07 Priority changed: LOW → MEDIUM
  10. 2026-10-07 CISA SSVC decision points changed
  11. 2026-10-07 Priority changed: MEDIUM → HIGH
  12. 2026-10-15 Added to CISA KEV
  13. 2026-10-15 CISA SSVC decision points changed
  14. 2026-10-16 EPSS moved to the 95th–99th percentile
  15. 2026-10-16 CVSS score added · NVD
  16. 2026-10-16 CISA SSVC decision points changed
  17. 2026-10-16 Priority changed: HIGH → CRITICAL
  18. 2026-10-20 CVSS score added · NVD
  19. 2026-10-25 EPSS moved to the 99th percentile and above
  20. 2026-10-29 CISA SSVC decision points changed

References

Advisory 9

  • TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2016-04529 Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict… CVSS 3.0CRITICAL 9.8
  • TI-2015-06881 An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-07936 The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x… CVSS 3.0CRITICAL 9.8
  • TI-2026-17399 Code injection in Atlassian Bamboo Data Center CVSS 4.0HIGH 8.6
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences