{"type":"bundle","id":"bundle--2eafe5a9-cafc-5cca-8028-45d5bdb9dad5","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--052831bb-ca25-5fd8-b7b5-a4c4542c0908","created":"2026-10-15T17:35:52.612Z","modified":"2026-10-15T17:35:52.612Z","name":"Atlassian Data Center lets strangers read files from Jira, Confluence and Bitbucket (CVE-2026-21589)","description":"CVE-2026-21589 lets an unauthenticated attacker read specific files inside the web application root of self-hosted Atlassian Data Center products. Atlassian published fixes on 2026-10-05. watchTowr reports in-the-wild exploitation observed as of 2026-10-06, and CISA added the CVE to KEV on 2026-10-15. Atlassian Cloud is patched with no evidence of exploitation found.","aliases":["CVE-2026-21589","Atlassian arbitrary file access","Jira Confluence pre-auth file read"],"first_seen":"2026-10-06T00:00:00Z","last_seen":"2026-10-15T17:00:11Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Atlassian security advisory CVE-2026-21589","url":"https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html"},{"source_name":"NVD CVE-2026-21589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21589"},{"source_name":"CISA Known Exploited Vulnerabilities catalog (2026.10.15)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"source_name":"watchTowr Labs research","url":"https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/"},{"source_name":"watchTowr Intel FAQ CVE-2026-21589","url":"https://watchtowr.com/intelligence/atlassian-arbitrary-file-access-vulnerability-jira-confluence-cve-2026-21589-faq/"},{"source_name":"HOL blog: CVE-2026-21589 operator write-up","url":"https://hol.org/blog/cve-2026-21589-atlassian-data-center-arbitrary-file-access-kev"}]}]}