DaystoPatch

AtlassianExploited incident

Arbitrary File Access Vulnerability impacts Multiple Atlassian Data Center Products

CVE-2026-21589Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 15 Oct 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statementUnverified source
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Atlassian security advisory CVE-2026-21589CuratedQuote verified

    05 Oct 2026

    Value of the advisory's 'Advisory Release Date' field. The vendor advisory was the first public signal; watchTowr's technical write-up and PoC followed on 6 Oct 2026 and exploitation attempts were reported within hours of that.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:551c26d21b15ec42…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Atlassian advisory CVE-2026-21589ClaimedQuote not found in archive5 Oct 2026

    CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products | Atlassian Support | Atlassian Documentation Products Resources Search Log in View account View

    The vendor's own disclosure.

    Source
    Atlassian advisory CVE-2026-21589 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:d00ed773f2fc194a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-21589ClaimedQuote verified5 Oct 2026, 21:30 UTC

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d4f4c87c10ae4499…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet6 Oct 2026, 00:07 UTC

    🚨 CVE-2026-21589 — CVSS 9.3 CRITICAL

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet6 Oct 2026, 02:08 UTC

    Atlassian Data Center vulnerability CVE-2026-21589 (CVSS 9.3) allows arbitrary file access in Jira, Confluence and Bitbucket. Patch now. # Atlassian # Jira # Confluence # Bitbucket # CVE202621589 # PathTraversal

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: watchtowrClaimedQuote verified6 Oct 2026, 17:01 UTC

    You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

    Earliest mention we hold (a vetted outlet).

    Source
    Research: watchtowr research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d89ad0e6238f050…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet8 Oct 2026, 13:26 UTC

    Atlassian Jira, Confluence Pre-Auth Arbitrary File Read (CVE-2026-21589)

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-21589)ClaimedQuote verified15 Oct 2026

    Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

    Added to CISA's KEV catalog on 2026-10-15.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame dayUnverified: quote not found in the archived copy

    Atlassian advisory CVE-2026-21589ClaimedQuote not found in archive

    CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products | Atlassian Support | Atlassian Documentation Products Resources Search Log in View account View

    Source
    Atlassian advisory CVE-2026-21589 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:d00ed773f2fc194a…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Atlassian security advisory CVE-2026-21589CuratedQuote verified5 Oct 2026

    05 Oct 2026

    'Advisory Release Date' field. Page footer also reads 'Last modified on Oct 5, 2026'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:551c26d21b15ec42…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Atlassian security advisory CVE-2026-21589CuratedQuote verified

    Apply a rule, described below, to your Web Application Firewall or proxy layer.

    Temporary mitigations (WAF regex, Tomcat RewriteValve, Bitbucket urlrewrite rule) were in the advisory released 05 Oct 2026; the page was last modified Oct 5, 2026.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:551c26d21b15ec42…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    Atlassian security advisory CVE-2026-21589CuratedQuote verified

    Atlassian recommends that you patch each of your affected installations to fixed versions or the latest version.

    Fixed versions were listed in the advisory released 05 Oct 2026 (e.g. Jira Software DC 9.12.40 / 10.3.26 / 11.3.12; Confluence DC 9.2.26 / 10.2.19).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:551c26d21b15ec42…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Atlassian advisory CVE-2026-21589ClaimedQuote verified5 Oct 2026

    Advisory Release Date 05 Oct 2026

    advisory published with a Fixed Versions table

    Source
    Atlassian advisory CVE-2026-21589 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:36ef8e947ec3c72c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Atlassian security advisory CVE-2026-21589CuratedQuote verified

    Last modified on Oct 5, 2026

    The fixed-versions table at release covers every product and LTS line listed (Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, JSM 5.12.40/10.3.26/11.3.12, Jira 9.12.40/10.3.26/11.3.12, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Crucible and Fisheye 4.9.15) and the page has not been modified since, so all branches are treated as fixed at release.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:551c26d21b15ec42…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Bitbucket Data Center
  • Confluence Data Center
  • Jira Service Management Data Center
  • Jira Software Data Center
  • Bamboo Data Center
  • Crowd Data Center
  • Crucible
  • Fisheye
How we built this timeline

Coordinated disclosure, exploited after the fix: advisory with fixes released 05 Oct 2026; watchTowr published technical details and a PoC on 6 Oct 2026; BleepingComputer (Bill Toulas, October 7, 2026 08:49 AM) reports Previdian saw exploitation attempts 'Within two hours of watchTowr publishing its technical research and public PoC' (source: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/).

Atlassian says Cloud was patched with no evidence of exploitation. CVSS is Atlassian's own CVSS 4.0 score (9.3).

The advisory gives a date only, no time of day.

Related

No related incidents.

Atlassian report card