{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-21589",
  "revision": 1,
  "title": "Atlassian Data Center — Unauthenticated Web-Root File Access",
  "summary": "Several Atlassian Data Center products let a remote attacker without a login read specific files in the web application root. The attacker must already know each file's exact name and path, and cannot list directories, but some configurations hold sensitive files there.",
  "source_type": "cve",
  "severity": "high",
  "cvss": {
    "score": 7.5,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "version": "3.1"
  },
  "epss": 0.99664,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": false,
    "attack_complexity": "low",
    "kev_added": "2026-10-15",
    "kev_due": "2026-10-18",
    "prerequisites": "Network access to an affected instance and prior knowledge of the target file's exact name and path."
  },
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1",
      "Confluence Data Center 9.2.26, 10.2.19",
      "Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4",
      "Jira Software Data Center 9.12.40, 10.3.26, 11.3.12",
      "Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12",
      "Bamboo Data Center 10.2.24, 12.1.12",
      "Crucible 4.9.15",
      "Fisheye 4.9.15"
    ]
  },
  "recommended_action": "Update every affected Atlassian Data Center product to its fixed version, then check the web root for sensitive files.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-21589",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://jira.atlassian.com/browse/BAM-26567"
    },
    {
      "type": "vendor_advisory",
      "url": "https://jira.atlassian.com/browse/BSERV-20604"
    },
    {
      "type": "vendor_advisory",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104488"
    }
  ],
  "published_at": "2026-10-05T22:16:58.423Z",
  "issued_at": "2026-11-05T07:48:47.009Z",
  "tags": [
    "atlassian",
    "data-center",
    "file-access"
  ]
}