Request a Demo

CVE-2026-21589

Critical

Emerging Threat · 6 Oct 2026

Understand Your Exposure: Atlassian Arbitrary File Access Vulnerability (CVE-2026-21589).

At a glance

  • This vulnerability lets an unauthenticated attacker read specific files inside the web application root directory, provided they already know the exact file name and path.
  • All versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd Data Center, Crucible, and Fisheye are affected, up to the vendor's fixed releases.
  • Patches are available: update each product to its listed fixed version, such as Jira Software Data Center 9.12.40, 10.3.26, or 11.3.12.
  • watchTowr clients: Rapid Reaction has already assessed your surface and Active Defense rules are deployed.
We can rapidly deploy the watchTowr Platform to determine whether your organization is exposed and vulnerable — including instances that exist within shadow IT.

CVSS

9.3 (v4.0)

Exploitation

None reported

CISA KEV

Not listed

Vendor patch

Available

watchTowr check

Live

Rapid support

Find Out If You’re Affected

We onboard from outside, assess your exposure to this CVE, and come back with a validated answer, not a maybe.

Zero install · no infrastructure changes

Deployed and assessing within hours

How we answer it

Hour 0

You give us a domain. Nothing to install, no infrastructure change.

Hours

We reconstruct your external estate and locate every exposed instance an attacker could reach.

Same Day

You get a validated answer on exposure, and mitigation options if you cannot patch immediately.

What Teams Ask Us First?

Active Defense can push mitigation rules to the edge controls you already run, so exposed Atlassian Data Center and Server Products instances are protected while the patch is tested and rolled out. We then confirm the mitigation holds against the same exploitation technique.
Onboarding is simple: give us a domain and there is nothing to install. Rapid Reaction then checks your attack surface for CVE-2026-21589 and shows you exactly where you are exposed.
We validate exploitability rather than infer it from a version banner, using the same initial-access tradecraft a real attacker would. That is the difference between a version that is theoretically vulnerable and a host that is reachable and exploitable right now.
Attackers Don't Give Up. Neither Should Your Security Testing.

Zero install. No infrastructure changes. Uplift your security posture within hours of onboarding the watchTowr Platform.

Get Continuous Testing
Talk to our team
Find Out What an Attacker Can Reach Before They Do.

Point us at a domain. We reconstruct your real external estate and come back with validated exposure, not a theoretical CVE list.

Request a Demo
See the Platform
Disclosure to Exploitation Is Four Hours. Patching Is Not.

The watchTowr Platform validates your exposure to an emerging threat and mitigates it at the edge while the vendor patch is still in testing.

Get Continuous Testing
How the Platform works
We Find the Vulnerabilities. You Hear It From Us First.

watchTowr Labs publishes what is being exploited right now and whether it touches your estate, not vendor summaries written a week late.

Read the Research
Talk to our team
Your Exposure Changes Weekly. Annual Testing Cannot Describe It.

Continuous, fully external validation of what an attacker can actually exploit against your estate, at a 0.01% false-positive rate.

Get Continuous Testing
Read the case studies
See the Estate You Own, Including What No Asset List Holds.

Subsidiaries, forgotten infrastructure, shadow IT. We rebuild your external surface from a single domain, then validate what is exposed.

Request a Demo
Explore use cases