Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-21589

Quick assessment

Affected
Atlassian Bamboo Data Center
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

摘要 该漏洞存在于 Bitbucket Data Center、Confluence Data Center、Jira Service Management Data Center、Jira Software Data Center、Bamboo Data Center、Crowd Data Center、Crucible 和 Fisheye 中。此任意文件访问漏洞允许未经身份验证的攻击者在受影响版本中访问 Web 应用程序根目录中的特定文件。利用此漏洞需要攻击者事先知道目标文件的精确名称和路径；该漏洞不允许攻击者

CVSS 9.3 · Critical EPSS 1.75% · P77

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 27

VendorProduct Version RangeStatus
Atlassian Bamboo Data Center All other versions affected
Patch version 10.2.24 and later unaffected
Patch version 12.1.12 and later unaffected
Atlassian Bitbucket Data Center All other versions affected
Patch version 10.2.8 and later unaffected
Patch version 10.5.1 and later unaffected
Patch version 9.4.26 and later unaffected
Atlassian Confluence Data Center All other versions affected
Patch version 10.2.19 and later unaffected
Patch version 9.2.26 and later unaffected
Atlassian Crowd Data Center All other versions affected
Patch version 7.2.4 and later unaffected
Patch version 7.1.7 and later unaffected
Patch version 7.0.3 and later unaffected
Patch version 6.3.7 and later unaffected
Atlassian Crucible Data Center All other versions affected
Patch version 4.9.15 and later unaffected
Atlassian Fisheye Data Center All other versions affected
Patch version 4.9.15 and later unaffected
Atlassian Jira Service Management Data Center All other versions affected
Patch version 11.3.12 and later unaffected
Patch version 10.3.26 and later unaffected
Patch version 5.12.40 and later unaffected
Atlassian Jira Software Data Center All other versions affected
Patch version 11.3.12 and later unaffected
Patch version 10.3.26 and later unaffected
Patch version 9.12.40 and later unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-21589

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Atlassian Bamboo Data Center All other versions -
Atlassian Bitbucket Data Center All other versions -
Atlassian Confluence Data Center All other versions -
Atlassian Crowd Data Center All other versions -
Atlassian Crucible Data Center All other versions -
Atlassian Fisheye Data Center All other versions -
Atlassian Jira Service Management Data Center All other versions -
Atlassian Jira Software Data Center All other versions -

II. Public POCs for CVE-2026-21589

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-21589

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-21589 (3)

Vendor Advisories for CVE-2026-21589 (4)

Other References for CVE-2026-21589 (1)

IV. Related Vulnerabilities

Same product: Bamboo Data Center
Same vendor: Atlassian

V. Comments for CVE-2026-21589

No comments yet

Leave a comment