CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
High⚠ Actively exploited (CISA KEV)
High
Severity
Active
CISA KEV
No
Ransomware use
Oct 18, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on Oct 15, 2026, with a federal patch deadline of Oct 18, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye)…
Details
AffectedAtlassian · Multiple Products
WeaknessCWE-552
Added to CISA KEVOct 15, 2026
Federal patch deadlineOct 18, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-21589 being actively exploited?
Yes — CISA lists CVE-2026-21589 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-21589 affect?
CVE-2026-21589 affects Atlassian · Multiple Products.
How do I fix CVE-2026-21589?
Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 18, 2026. Then check whether your personal data was exposed in any related breach.