CVE-2026-21589Published

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability …

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-21589

Published

Bamboo Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Bamboo Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 10.2.24 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 12.1.12 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Bitbucket Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Bitbucket Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 10.2.8 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 10.5.1 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 9.4.26 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Confluence Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Confluence Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 10.2.19 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 9.2.26 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Crowd Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Crowd Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 7.2.4 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 7.1.7 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 7.0.3 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 6.3.7 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Crucible Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Crucible Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 4.9.15 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Fisheye Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Fisheye Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 4.9.15 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Jira Service Management Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Jira Service Management Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 11.3.12 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 10.3.26 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 5.12.40 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Jira Software Data Center

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Atlassian",
                    "product": "Jira Software Data Center",
                    "versions": [
                        {
                            "version": "All other versions",
                            "status": "affected"
                        },
                        {
                            "version": "Patch version 11.3.12 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 10.3.26 and later",
                            "status": "unaffected"
                        },
                        {
                            "version": "Patch version 9.12.40 and later",
                            "status": "unaffected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON