Federal civilian agencies have until 18 Oct to remediate. The bug affects multiple Atlassian Data Center products; CISA lists ransomware use as unknown.
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on Thursday, based on evidence of active exploitation. The vulnerability is an arbitrary file-access flaw affecting Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center products, plus Crucible and Fisheye. Atlassian says an unauthenticated attacker who already knows a file’s exact name and path can read specific files under the web application root; the flaw does not let attackers list directories. Federal civilian agencies must remediate by 18 October. CISA lists known ransomware campaign use as unknown and flags forensic triage under BOD 26-04. Atlassian Cloud products are patched, the vendor says; Data Center operators should move to the listed fixed versions.
Sources: CISA · CISA KEV catalog · Atlassian · Security Affairs