PolicyCortex
Request Access
Summary
  • [CVE-2026-21589](https://www.cve.org/CVERecord?id=CVE-2026-21589) is an unauthenticated arbitrary file access flaw in the shared atlassian-plugins-webresource component, scored CVSS 9.3 Critical.
  • Eight products are affected: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center. Atlassian Cloud is already patched.
  • CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 15, 2026, with a federal remediation deadline of October 18, 2026.
  • Public proof of concept scripts exist. Rapid7 honeypots recorded exploitation attempts within about two hours of the October 5 advisory.
  • The fix is eight upgrades, one shared evidence packet: advisory reference, version found, fixed version installed, date, and verification.

One component, eight products, no login

CVE is Common Vulnerabilities and Exposures. On October 5, 2026, Atlassian published an advisory for CVE-2026-21589. The flaw allows unauthenticated arbitrary file access.

The flaw lives in atlassian-plugins-webresource, a component the products share. One vulnerable component feeds eight products. The fix is eight upgrades, but the evidence packet is one.

How the access works

The attacker names the exact file name and path. The server returns the file contents. No login comes first.

There is no directory listing. The attacker cannot browse around. But some configurations expose sensitive files, including credentials. That raises the risk from a leak to a foothold.

CVSS is the Common Vulnerability Scoring System. The flaw scores CVSS v4 9.3, Critical.

Which products are in range

All versions before the fixed builds are affected. That covers Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, and Jira Service Management Data Center. It also covers Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.

Atlassian Cloud is already patched. No Cloud customer action is needed.

The fixed builds

Upgrade to these builds or later. Bitbucket 9.4.26, 10.2.8, 10.5.1. Confluence 9.2.26, 10.2.19.

Jira Software 9.12.40, 10.3.26, 11.3.12. Jira Service Management 5.12.40, 10.3.26, 11.3.12. Bamboo 10.2.24, 12.1.12.

Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4. Crucible 4.9.15. Fisheye 4.9.15.

How fast this moved

PoC is proof of concept. Public proof of concept scripts exist for this flaw.

Rapid7 reported public proof of concept scripts. Its honeypots saw exploitation attempts within about two hours of the October 5 advisory.

CISA is the Cybersecurity and Infrastructure Security Agency. Its Known Exploited Vulnerabilities catalog lists flaws attackers are actively exploiting. CISA added CVE-2026-21589 to the catalog on October 15, 2026. The federal remediation deadline was October 18, 2026.

Two hours from advisory to attack attempts. That gap is the real clock. Patch calendars should beat it.

Which compliance rules does this touch?

NIST is the National Institute of Standards and Technology. Its catalog is NIST SP 800-53 Revision 5.

Flaw repair is control SI-2. SI is system and information integrity. In NIST 800-171, it is practice 3.14.1. Both ask you to find flaws, fix them, and prove the fix.

Incident handling is control IR-4 and practice 3.6.1. If a credential file may have been read, that is an incident, not a ticket.

Defense work adds a hard clock. DFARS is the Defense Federal Acquisition Regulation Supplement. Clause 252.204-7012 can require a cyber incident report to DoD within 72 hours. It also requires keeping images and logs for 90 days.

The System Security Plan should name every affected product with its owner and patch owner. SSP is System Security Plan. A product missing from the inventory is a product nobody patches.

The evidence packet to keep

Keep five items per product. Keep the advisory reference for the flaw. Keep the version found on the server. Keep the fixed version installed.

Keep the patch date and time of restart. Keep the verification scan showing the flaw is gone.

If a server faced the internet on an old build, check whether credential files were exposed. Record what you looked for and what you found.

What PolicyCortex does not do

PolicyCortex does not patch these products and does not clean compromised hosts. PolicyCortex collects evidence from live Azure configuration and ties each control to the setting that met it.

The habit is the same one this flaw demands. Proof from the system itself, not from memory.

Sources

Questions on this record
What is CVE-2026-21589?
An unauthenticated arbitrary file access flaw in the atlassian-plugins-webresource component shared by eight Atlassian Data Center products. An attacker who knows the exact file name and path can read the file with no login. It scores CVSS 9.3 Critical and sits in the CISA KEV catalog.
Which products are affected?
Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, and Jira Service Management Data Center are affected. Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye are affected too. All versions before the fixed builds are in range. Atlassian Cloud is already patched, so Cloud customers need no action.
Which versions fix it?
Bitbucket 9.4.26, 10.2.8, 10.5.1. Confluence 9.2.26, 10.2.19. Jira Software 9.12.40, 10.3.26, 11.3.12. Jira Service Management 5.12.40, 10.3.26, 11.3.12. Bamboo 10.2.24, 12.1.12. Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4. Crucible 4.9.15. Fisheye 4.9.15.
Is it being exploited in the wild?
Yes. Rapid7 reported public proof of concept scripts and said its honeypots saw exploitation attempts within about two hours of the October 5 advisory. CISA added the flaw to the Known Exploited Vulnerabilities catalog on October 15, 2026, which means CISA confirms active exploitation.
What proof should we keep after patching?
Keep the advisory reference and the version found on each server. Keep the fixed version installed, plus the patch date and restart time. Keep a verification scan showing the flaw is gone. If a credential file may have been read, keep disk images and logs for 90 days under DFARS 252.204-7012.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. Arista VeloCloud Orchestrator Zero-Day: A Signed-In User Becomes SuperuserArista confirms active exploitation of the on-premises VeloCloud Orchestrator flaw. A signed-in user can reach superuser rights through SQL injection.5 min
  2. GitLab Critical Flaw: Unauthenticated Code Execution on the ServerCVE-2026-110264 scores 10.0 Critical and lets an unauthenticated user run code on a GitLab server. The fix is a patch release.5 min
  3. Four Exploited Flaws Hit the Firewall, the Mail Gateway, and the Backup ServerCISA added four exploited flaws on October 14, 2026. They hit a Palo Alto Networks firewall, a Cisco email gateway, and an Ahsay backup server.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere