# CVE-2026-21589: Atlassian - Arbitrary File Read

> Live exploitation tracking for CVE-2026-21589 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-21589

## Key facts

- **Exploitation phase:** Early Exploitation. Early exploitation attempts have been observed, but activity remains limited and not yet widespread.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Atlassian Bamboo Data Center, Atlassian Bitbucket Data Center, Atlassian Confluence Data Center, Atlassian Crowd Data Center, Atlassian Crucible Data Center, Atlassian Fisheye Data Center, Atlassian Jira Service Management Data Center, Atlassian Jira Software Data Center
- **Weaknesses:** CWE-552 (Files or Directories Accessible to External Parties)
- **Tags:** cicd, scm, wiki

## Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

## CrowdSec analysis

[CVE-2026-21589](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-21589) is a critical arbitrary file access vulnerability affecting Atlassian Data Center products, including Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software. An unauthenticated remote attacker who knows a file’s exact name and path can access specific files within the web application’s root directory, potentially exposing sensitive information; the flaw does not allow directory listing or file enumeration.

CrowdSec has been tracking this vulnerability and its exploits since 7th of October 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-21589 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-21589 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-21589 is currently experiencing high visibility and active exploitation across the internet.

Attackers target Atlassian resource-download endpoints such as `/download/resources/` and `/s/1/_/download/resources/`, supplying resource paths containing repeated `..::` traversal sequences to read files from the application webroot. Common targets include `WEB-INF/web.xml`, `WEB-INF/urlrewrite.xml`, and potentially `WEB-INF/classes/crowd.properties`.

## Timeline

- 2026-10-05: CVE Published. CVE-2026-21589 is published to NVD.
- 2026-10-07: Rule Released. CrowdSec releases a rule to detect CVE-2026-21589 exploitation attempts against the CrowdSec Network.
- 2026-10-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-21589 for the first time.

## References

- https://jira.atlassian.com/browse/JRASERVER-79546
- https://jira.atlassian.com/browse/CONFSERVER-104488
- https://jira.atlassian.com/browse/BAM-26567
- https://jira.atlassian.com/browse/CRUC-8741
- https://jira.atlassian.com/browse/FE-7583
- https://jira.atlassian.com/browse/CWD-6610
- https://jira.atlassian.com/browse/BSERV-20604
- https://jira.atlassian.com/browse/JSDSERVER-16809
- https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-21589) follows observed exploitation activity for CVE-2026-21589. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.