CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog on 15 October 2026. The flaw is an unauthenticated file-access bug in several self-hosted Atlassian products. Atlassian rates it CVSS 9.3. US federal agencies have until 18 October 2026 to remediate it.
What happened
Atlassian published the advisory on 5 October 2026. An attacker who already knows the exact name and path of a file inside the web application root can read that file without logging in. The bug does not list directory contents. Atlassian says some setups keep sensitive files there, including configuration that can hold credentials or tokens. CISA's 15 October alert is the public confirmation of active exploitation. Atlassian Cloud is already patched. Self-hosted Server editions of several products are affected and, on the older Server line, have no fixed build.
Who is affected
- Self-hosted Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center builds older than the fixed releases.
- Crucible and Fisheye before 4.9.15.
- End-of-life Server editions of Bitbucket, Confluence, Bamboo and Crowd, which the CVE record marks affected with no fix listed.
Fixed Data Center builds named by Atlassian include Bitbucket 9.4.26, 10.2.8 and 10.5.1; Confluence 9.2.26 and 10.2.19; Jira Software and Jira Service Management 9.12.40 or 5.12.40, 10.3.26 and 11.3.12; Bamboo 10.2.24 and 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 and 7.2.4. Match the fix to your branch. A higher number on a different branch is not automatically patched. Atlassian Cloud customers do not need to act on this CVE.
What to do now
Upgrade every internet-facing self-hosted instance to the fixed build for its branch before 18 October.
- Inventory Jira, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Cloud tenants can be marked out of scope.
- Upgrade to the fixed version on the same release branch. Do not assume a newer-looking build on another branch is safe.
- If a Server edition has no fix, take it off the internet or replace it. A WAF rule is a bridge, not a patch.
- After patching, review application logs for requests that ask for known sensitive filenames under the web root, and rotate any credential that lived in a file an outsider could have named.
What this means for South African businesses
Most small firms here are on Atlassian Cloud and can ignore this one. The exposure is the self-hosted Confluence or Jira box still sitting on a company VM, often installed years ago and forgotten after the team moved to cloud. Those boxes are exactly the kind of internet-facing app an MSP inherits and rarely patches on a weekly cycle. If you still host one, treat 18 October as your own deadline, not only a US federal date. A file read that needs a known path sounds narrow until the path is a default config file every install shares.
Source: CISA.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.