CVE-2026-21589
Bamboo Data Center95/100
confirmed exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate
Listed in VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.028 (probability of exploitation) · CVSS base 9.3 · 13 public PoC/exploit reference(s) available
Public PoC / Exploit13
Defensive review only — these references demonstrate exploitability.
nuclei-templateAtlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Readgithubwatchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 (★13)githubMarcusProgram/CVE-2026-21589 (★10)githubtc4dy/CVE-2026-21589-PoC-Exploit (★9)githubynsmroztas/AtlasSniper (★8)githubmurrez/CVE-2026-21589 (★1)vulncheck-xdbVulnCheck XDB 966813b9 (info-leak)vulncheck-xdbVulnCheck XDB 5818e155 (info-leak)vulncheck-xdbVulnCheck XDB 2739faa4 (info-leak)vulncheck-xdbVulnCheck XDB 9f37f10a (info-leak)vulncheck-xdbVulnCheck XDB 46cc1659 (info-leak)vulncheck-xdbVulnCheck XDB 96f9a17d (initial-access)githubaduli198/CVE-2026-21589 (★0)
References9
Mentions 15