EXPOSURES › CVE-2026-21589
CVE-2026-21589
HIGH ⌖ ON CISA KEV · EXPLOITEDAn unauthenticated attacker could access specific files within the web application root directory of multiple Atlassian Data Center products due to a directory traversal vulnerability.
This directory traversal flaw allows external parties to read sensitive files from the application root, exposing configuration data, credentials, or proprietary code. DIB organizations using Atlassian Data Center products must immediately patch affected versions to prevent information disclosure and potential lateral movement. The vulnerability is actively exploited in the wild, indicating a high risk of real-world compromise.
Shame score — A directory traversal vulnerability in widely deployed Data Center products that is actively exploited in the wild represents a severe, avoidable failure in secure coding and patch management.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.