Description
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Published: 2026-10-05
Score: 9.3 Critical
EPSS: 99.5% High
KEV: Yes
Impact: Arbitrary File Access (Unauthenticated)
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated remote attacker can read selected files in the root directory of Atlassian Data Center products. The flaw can lead to disclosure of configuration files, logs, or other sensitive data, compromising confidentiality and potentially enabling further attacks. The weakness relies on improper access control, allowing file‑system reading without authentication.

Affected Systems

The vulnerability covers several Atlassian Data Center products: Bitbucket, Confluence, Crowd, Jira Software, Jira Service Management, Bamboo, Crucible, and Fisheye. Vulnerable versions begin at Bitbucket 4.6.0, Confluence 5.10.0, Crowd 2.11.0, Jira Software 7.1.0, Jira Service Management 3.1.0, Bamboo 7.0.1, and the fixed releases are 9.4.26, 10.2.8, 10.5.1 for Bitbucket; 9.2.26, 10.2.19 for Confluence; 6.3.7, 7.0.3, 7.1.7, 7.2.4 for Crowd; 9.12.40, 10.3.26, 11.3.12 for Jira Software and Service Management; 10.2.24, 12.1.12 for Bamboo; and 4.9.15 for Crucible and Fisheye. In all affected releases the application’s web root exposes sensitive files when the file name and path are known.

Risk and Exploitability

The CVSS score of 9.3 classifies this flaw as critical. The EPSS score of 99% indicates a very high probability of exploitation. The presence of a KEV listing confirms that the vulnerability has been actively exploited in the wild. Payloads require a crafted HTTP request that references the exact file path, and no directory enumeration is possible. Solutions must therefore be applied promptly, and mitigation should focus on restricting file‑system access and blocking known malicious patterns.

Generated by OpenCVE AI on October 25, 2026 at 17:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply all vendor patches or upgrade to the fixed versions for each affected Atlassian product
  • If an upgrade is not immediately feasible, configure a reverse proxy or web application firewall to reject HTTP requests that target paths within the web‑application root (e.g., /config, /etc)
  • Enforce strict file‑system permissions so that the web‑server process cannot read admin‑level configuration files and validate that only approved directories are exposed in the application root

Generated by OpenCVE AI on October 25, 2026 at 17:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Arbitrary File Access in Atlassian Data Center Applications

Mon, 19 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Mon, 19 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Atlassian bamboo
Atlassian crowd
Atlassian jira Data Center
Atlassian jira Service Desk
CPEs cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
Vendors & Products Atlassian bamboo
Atlassian crowd
Atlassian jira Data Center
Atlassian jira Service Desk
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Mon, 19 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Title Arbitrary File Access in Atlassian Data Center Applications
Weaknesses CWE-200
CWE-284

Mon, 19 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-552
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record. This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-552
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
Vendors & Products Atlassian bamboo
Atlassian crowd
Atlassian jira Data Center
Atlassian jira Service Desk
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Fri, 16 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents. This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Fri, 16 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Atlassian jira Service Desk
CPEs cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
Vendors & Products Atlassian jira Service Desk

Thu, 15 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Atlassian bamboo
Atlassian crowd
Atlassian jira Data Center
CPEs cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
Vendors & Products Atlassian bamboo
Atlassian crowd
Atlassian jira Data Center
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Thu, 15 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-10-15T00:00:00+00:00', 'dueDate': '2026-10-18T00:00:00+00:00'}

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Title Arbitrary File Access in Atlassian Data Center Products

Wed, 07 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Title Arbitrary File Access in Atlassian Data Center Products

Wed, 07 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Arbitrary File Access in Atlassian Data Center Products
Weaknesses CWE-200
CWE-284

Wed, 07 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Atlassian
Atlassian bamboo Data Center
Atlassian bamboo Server
Atlassian bitbucket Data Center
Atlassian bitbucket Server
Atlassian confluence Data Center
Atlassian confluence Server
Atlassian crowd Data Center
Atlassian crucible
Atlassian crucible Data Center
Atlassian fisheye
Atlassian fisheye Data Center
Atlassian jira Server
Atlassian jira Service Management
Atlassian jira Service Management Data Center
Atlassian jira Software Data Center
Atlassian jira Software Server
Vendors & Products Atlassian
Atlassian bamboo Data Center
Atlassian bamboo Server
Atlassian bitbucket Data Center
Atlassian bitbucket Server
Atlassian confluence Data Center
Atlassian confluence Server
Atlassian crowd Data Center
Atlassian crucible
Atlassian crucible Data Center
Atlassian fisheye
Atlassian fisheye Data Center
Atlassian jira Server
Atlassian jira Service Management
Atlassian jira Service Management Data Center
Atlassian jira Software Data Center
Atlassian jira Software Server

Tue, 06 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe.   h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents. This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-552
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Arbitrary File Access in Atlassian Data Center Products
Weaknesses CWE-200
CWE-284

Mon, 05 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe.   h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents.
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

Atlassian Bamboo Bamboo Data Center Bamboo Server Bitbucket Data Center Bitbucket Server Confluence Data Center Confluence Server Crowd Crowd Data Center Crucible Crucible Data Center Fisheye Fisheye Data Center Jira Data Center Jira Server Jira Service Desk Jira Service Management Jira Service Management Data Center Jira Software Data Center Jira Software Server
cve-icon MITRE

Status: PUBLISHED

Assigner: atlassian

Published:

Updated: 2026-10-19T18:26:40.891Z

Reserved: 2026-01-01T00:00:40.722Z

Link: CVE-2026-21589

cve-icon Vulnrichment

Updated: 2026-10-06T13:51:25.309Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-05T22:16:58.423

Modified: 2026-10-26T10:10:00.140

Link: CVE-2026-21589

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T17:30:16Z

Weaknesses
  • CWE-552

    Files or Directories Accessible to External Parties