CVE-2026-21589 · Critical · CISA KEV

Atlassian Data Center Vulnerability: Unauthenticated File Access in KEV

Threat Engine Auto-Feed · data current as of 2026-10-15

A critical vulnerability (CVE-2026-21589) in multiple Atlassian Data Center products allows unauthenticated attackers to access specific files within the web application root directory. This flaw is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog, indicating a high probability of further exploitation.

  • CVSS:
  • EPSS percentile: 0.86118
  • Exploitation pressure: 77/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 86th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves files or directories that are improperly accessible to external parties. This means that certain sensitive files or directories within the web application's root directory can be accessed by an attacker without needing any authentication.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Atlassian Data Center products (Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, Fisheye)
  • Financial services organizations (due to documented targeting by FIN7, LockBit affiliates, APT38)
  • Technology sector organizations (due to documented targeting by APT29, Scattered Spider)

Misconfigurations that escalate it

  • Failure to restrict access to the web application root directory
  • Lack of proper file permissions on sensitive Atlassian product files

High-impact scenarios

  • Unauthorized access to sensitive configuration files or data
  • Information disclosure that could aid further attacks
  • Potential for escalation of privileges or system compromise if accessed files contain critical information

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Atlassian product logs for unusual file access patterns or unauthenticated access attempts to sensitive directories.
  • Scan Atlassian Data Center deployments for publicly accessible files or directories within the web application root.
  • Implement network intrusion detection systems (NIDS) to identify suspicious traffic patterns targeting Atlassian instances.

Contain

  • Isolate affected Atlassian Data Center instances from the internet if immediate patching is not feasible.
  • Review and restrict network access controls to Atlassian Data Center products to only necessary internal users and services.

Patch

  • Apply the latest security patches and updates provided by Atlassian for all affected Data Center products immediately.

Frontier verdict — Critical

This vulnerability is critical due to active exploitation in the wild (CISA KEV) and allows unauthenticated file access in widely used Atlassian Data Center products, demanding immediate patching.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.