critical severityConfidence highHistorical record

Atlassian Data Center lets strangers read files from Jira, Confluence and Bitbucket (CVE-2026-21589)

CVE-2026-21589 lets an unauthenticated attacker read specific files inside the web application root of self-hosted Atlassian Data Center products. Atlassian published fixes on 2026-10-05. watchTowr reports in-the-wild exploitation observed as of 2026-10-06, and CISA added the CVE to KEV on 2026-10-15. Atlassian Cloud is patched with no evidence of exploitation found.

Also tracked as CVE-2026-21589 · Atlassian arbitrary file access · Jira Confluence pre-auth file read

First observed
Oct 6, 2026
Last observed
Oct 15, 2026
Last reviewed
Oct 15, 2026
Tracking ended
Oct 15, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Impact depends on which sensitive files sit in the web app root; the attacker must know the exact path. Atlassian found no Cloud exploitation.

  • Atlassian Cloud already patched, no customer action
  • Requires exact file path; no directory listing
  • Reads files under web app root only; not RCE by itself

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Atlassian advisory and fixed releases for eight Data Center products.

  2. First observed

    watchTowr publishes research; its FAQ says watchTowr Intel observed in-the-wild exploitation as of Oct 6.

  3. Update

    CISA adds CVE-2026-21589 to KEV (catalog 2026.10.15), federal due date 2026-10-18.

Publication clock: 0.6 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-D85069F0