{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-D85069F0",
  "slug": "cve-2026-21589-atlassian-data-center-arbitrary-file-access-kev",
  "title": "Atlassian Data Center lets strangers read files from Jira, Confluence and Bitbucket (CVE-2026-21589)",
  "aliases": [
    "CVE-2026-21589",
    "Atlassian arbitrary file access",
    "Jira Confluence pre-auth file read"
  ],
  "summary": "CVE-2026-21589 lets an unauthenticated attacker read specific files inside the web application root of self-hosted Atlassian Data Center products. Atlassian published fixes on 2026-10-05. watchTowr reports in-the-wild exploitation observed as of 2026-10-06, and CISA added the CVE to KEV on 2026-10-15. Atlassian Cloud is patched with no evidence of exploitation found.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Impact depends on which sensitive files sit in the web app root; the attacker must know the exact path. Atlassian found no Cloud exploitation.",
  "firstObservedAt": "2026-10-06T00:00:00Z",
  "lastObservedAt": "2026-10-15T17:00:11Z",
  "publishedAt": "2026-10-15T17:35:52.612Z",
  "reviewedAt": "2026-10-15T17:35:43.627Z",
  "expiresAt": "2026-10-15T17:00:11Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "atlassian",
      "label": "Atlassian security advisory CVE-2026-21589",
      "url": "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-05T00:00:00Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-21589",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-15T17:00:11Z"
    },
    {
      "id": "kev",
      "label": "CISA Known Exploited Vulnerabilities catalog (2026.10.15)",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "sourceType": "government",
      "observedAt": "2026-10-15T17:00:11Z"
    },
    {
      "id": "watchtowr",
      "label": "watchTowr Labs research",
      "url": "https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/",
      "sourceType": "research",
      "observedAt": "2026-10-06T00:00:00Z"
    },
    {
      "id": "watchtowr-faq",
      "label": "watchTowr Intel FAQ CVE-2026-21589",
      "url": "https://watchtowr.com/intelligence/atlassian-arbitrary-file-access-vulnerability-jira-confluence-cve-2026-21589-faq/",
      "sourceType": "research",
      "observedAt": "2026-10-15T00:00:00Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL blog: CVE-2026-21589 operator write-up",
      "url": "https://hol.org/blog/cve-2026-21589-atlassian-data-center-arbitrary-file-access-kev",
      "sourceType": "other_primary",
      "observedAt": "2026-10-15T17:00:11Z"
    }
  ],
  "artifacts": [],
  "indicators": [],
  "timeline": [
    {
      "id": "atlassian-advisory",
      "occurredAt": "2026-10-05T00:00:00Z",
      "eventType": "vendor_action",
      "summary": "Atlassian advisory and fixed releases for eight Data Center products.",
      "sourceIds": [
        "atlassian"
      ]
    },
    {
      "id": "watchtowr-observed",
      "occurredAt": "2026-10-06T00:00:00Z",
      "eventType": "first_observed",
      "summary": "watchTowr publishes research; its FAQ says watchTowr Intel observed in-the-wild exploitation as of Oct 6.",
      "sourceIds": [
        "watchtowr",
        "watchtowr-faq"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-10-15T17:00:11Z",
      "eventType": "other",
      "summary": "CISA adds CVE-2026-21589 to KEV (catalog 2026.10.15), federal due date 2026-10-18.",
      "sourceIds": [
        "kev"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Atlassian Cloud already patched, no customer action",
    "Requires exact file path; no directory listing",
    "Reads files under web app root only; not RCE by itself"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-21589-atlassian-data-center-arbitrary-file-access-kev/corrections"
}