Atlassian CVE-2026-21589 added to CISA KEV: it is exploited

On 6 October ARX News covered Atlassian’s CVE-2026-21589, the arbitrary file access vulnerability in its Data Center products, based on advisories from CERT-FR, NCSC-NL, CERT-EU, BSI, NCSC-FI and the Canadian Centre for Cyber Security. At the time, the sources disagreed on exploitation. On 15 October 2026 CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, which lists vulnerabilities for which the agency has evidence of active exploitation. What follows is what is new compared with the first article.

What changes with the KEV listing

In the first article the picture was unclear: according to CERT-EU, Atlassian had found no evidence of exploitation; the Canadian Centre reported open sources indicating active exploitation; and NCSC-FI reported attempts observed against decoy systems after a proof of concept was published. With the KEV listing, CISA considers the vulnerability exploited.

The KEV entry does not describe the attacks: it names no victims, actors or indicators of compromise. Under known use in ransomware campaigns it says «Unknown».

The entry is titled «Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability» and asks organisations to:

• apply mitigations according to the vendor’s instructions, following CISA’s BOD 26-04 directive on prioritising security updates based on risk and its «Forensics Triage Requirements»;
• for cloud services, follow the same directive or stop using the product if mitigations are not available;
• assess the internet exposure of each asset.

For US federal agencies the deadline is 18 October 2026, three days after the listing. The deadline does not apply to European companies, but it shows the priority CISA assigns to the vulnerability.

The details added by NVD

The NVD entry, published on 5 October and updated on the 15th, is still marked «Awaiting Analysis»: NVD has not assigned its own score. Atlassian’s score stands, CVSS 4.0 9.3, with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H. This means a network attack, low complexity, no privileges and no user interaction; high impact on the confidentiality of the vulnerable system and no impact on its integrity and availability; high impact on the confidentiality, integrity and availability of subsequent systems. The weakness is classified as CWE-552 (files or directories accessible to external parties).

The description confirms the limitation already known: the attacker must know the exact name and path of the file and cannot list directory contents. It does, however, add the version in which the flaw was introduced for each product, which the first article did not include:

• Bitbucket Data Center: from 4.6.0; fixed versions 9.4.26, 10.2.8, 10.5.1;
• Confluence Data Center: from 5.10.0; fixed versions 9.2.26, 10.2.19;
• Crowd Data Center: from 2.11.0; fixed versions 6.3.7, 7.0.3, 7.1.7, 7.2.4;
• Jira Software Data Center: from 7.1.0; fixed versions 9.12.40, 10.3.26, 11.3.12;
• Jira Service Management Data Center: from 3.1.0; fixed versions 5.12.40, 10.3.26, 11.3.12;
• Bamboo Data Center: from 7.0.1; fixed versions 10.2.24, 12.1.12;
• Crucible and Fisheye: fixed version 4.9.15 (NVD does not state the version that introduced the flaw).

The fixed versions match the CERT-EU list given in the first article. The NVD description also explicitly lists Jira Service Management, which was missing from the CERT-FR advisory.

Among its references, NVD links Atlassian’s public tickets for each product: BSERV-20604 (Bitbucket), CONFSERVER-104488 (Confluence), CWD-6610 (Crowd), JRASERVER-79546 (Jira Software), JSDSERVER-16809 (Jira Service Management), BAM-26567 (Bamboo), CRUC-8741 (Crucible) and FE-7583 (Fisheye). There is also a public GitHub repository by watchTowr Labs dedicated to this CVE; NCSC-FI had already reported that a working proof of concept had been published.

Impact for European and Italian companies

According to CISA the vulnerability has been exploited, so an unpatched Data Center instance reachable from the internet should be treated as being at real risk. How serious a file read is depends on which files sit in the web application root directory; Atlassian warns that some configurations contain sensitive files.

The affected products hold tickets, documentation, source code, build pipelines and, with Crowd, centralised access management. For organisations in scope of NIS2, what the first article said still applies: handling exploited vulnerabilities is part of the required security measures, and the reading of credentials or secrets from an exposed system is an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.

What to do now

1. Update to the fixed versions or later, starting with internet-facing instances.
2. If you cannot update straight away, take the instance off the internet or apply Atlassian’s mitigations described in the first article: a WAF or proxy rule, Tomcat’s RewriteValve, or a rule in urlrewrite.xml for Bitbucket.
3. Check the versions of every instance, including cluster nodes, test environments and Bitbucket mirrors, against the list above and the Atlassian ticket for the product.
4. Carry out forensic triage, as CISA also requires: search access logs for .. sequences directly next to /, \ or ::, including URL-encoded forms, at least from 5 October, the date the CVE was published.
5. If you find traces: work out which files may have been read, replace credentials, API keys and other secrets that may have been exposed, check for new users and administrators, and assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your company exposes on the internet and which products with known vulnerabilities are detected on them: it helps you find out whether a Jira, Confluence or Bitbucket instance is reachable from outside. ARX Shield lists open vulnerabilities on monitored machines, highlighting those already exploited. With ARX Trace, analysts can launch collections and searches across multiple machines to look for traces.

Last updated: 15 October 2026