Skip to content
OpenAdvisories
Critical · 9.3 Known exploited Scanner template Public exploit CVE-2026-21589 EUVD-2026-92807GHSA-gr66-x5pq-8g2g

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, B…

Published Oct 5, 2026 · Updated Oct 29, 2026 · Assigned by atlassian

Vendor: Atlassian Product: Bamboo Data Center Product: Bitbucket Data Center Product: Confluence Data Center Product: Crowd Data Center Product: Crucible Data Center Product: Fisheye Data Center Product: Jira Service Management Data Center Product: Jira Software Data Center Category: Web / CMS

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Affected products

VendorProductAffectedFixed
Atlassian Bamboo Data Center All other versions Patch version 10.2.24 and later
Atlassian Bitbucket Data Center All other versions Patch version 10.2.8 and later
Atlassian Confluence Data Center All other versions Patch version 10.2.19 and later
Atlassian Crowd Data Center All other versions Patch version 7.2.4 and later
Atlassian Crucible Data Center All other versions Patch version 4.9.15 and later
Atlassian Fisheye Data Center All other versions Patch version 4.9.15 and later
Atlassian Jira Service Management Data Center All other versions Patch version 11.3.12 and later
Atlassian Jira Software Data Center All other versions Patch version 11.3.12 and later

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 13 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 2

References