CISA Adds Atlassian Multi-Product File Access Flaw to KEV Catalog

CISA added CVE-2026-21589, an Atlassian file-access flaw, to its Known Exploited Vulnerabilities catalog on October 15, 2026. Products affected range from Bitbucket Data Center and Confluence Data Center to Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.

The vulnerability allows unauthenticated file access. Without authentication, an attacker may retrieve certain files from the root directory of the web application in versions that remain vulnerable.

Stakeholders must evaluate internet exposure. Each asset requires review so that mitigations from the vendor can be implemented in line with CISA guidance on update prioritization and forensics triage, or the product can be phased out where necessary.

Vendor guidance is available at the listed link. Details appear in Atlassian's security bulletin. CISA set an October 18 due date for federal agencies to act under BOD 26-04. CISA lists ransomware use of the flaw as unknown.