CVE-2026-21589

Bamboo Data Center: Path Traversal (Arbitrary Read/Write)

Severity: 9.3CVSSv4.0
Exploitation: KEV listed 2026-10-15
EPSS: 99.48%as of 2026-10-25
Products: 8fix published

Actively exploited. Upgrade to the fixed version for your branch.

An unauthenticated remote attacker can read specific files inside the web application root of Atlassian Data Center products, provided they already know the file's exact name and path. Affected products include Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software Data Center. CVSSv4.0 is 9.3, EPSS is 0.99477 (99.943rd percentile as of 2026-10-25), and the bug is listed in CISA KEV with a remediation due date of 2026-10-18. Upgrade to the fixed versions listed in the version table.

Synthesised from 10 public sources. Context, not the facts above. Every point is attributed to the publisher that made it.

Conflicting fix boundaries

CERT-EU's full fix table lists Crowd 7.1.7 and Bamboo 12.1.12, but cyber.gc.ca cites Crowd 7.1.1 and Bamboo 10.2.4 instead. Confirm against Atlassian's dated bulletin before closing a ticket, the two sources disagree on which builds are remediated.

Non-upgrade mitigation exists

watchTowr reports Atlassian attached a rewrite.config mitigation file to the public Jira ticket on October 2, ahead of the October 5 advisory, a workaround for teams that cannot patch immediately. Atlassian's ticket also warns end-of-life versions may be vulnerable.

Escalation and detection

Greenbone says the read can escalate to admin account takeover when Crowd SSO is used; Atlassian stresses no directory enumeration, so exact paths are needed. CERT-EU advises checking access logs. Greenbone saw no KEV entry as of Oct 13; cyber.gc.ca says CISA added it Oct 15.

What to do

Upgrade each affected product you run to the fixed version shown. Where a product lists more than one version, pick the line that matches the release you are on, not the highest number.

Product	Fixed version
Bamboo Data Center	10.2.24 · 12.1.12
Bitbucket Data Center	10.2.8 · 10.5.1 · 9.4.26
Confluence Data Center	10.2.19 · 9.2.26
Crowd Data Center	6.3.7 · 7.0.3 · 7.1.7 · 7.2.4
Crucible Data Center	4.9.15
Fisheye Data Center	4.9.15
Jira Service Management Data Center	10.3.26 · 11.3.12 · 5.12.40
Jira Software Data Center	10.3.26 · 11.3.12 · 9.12.40

Why it matters

Exploited now

CISA has confirmed attackers are using this in real attacks, and set 2026-10-18 as the deadline to patch.

Likely to spread

EPSS estimates a 99.48% chance it is exploited in the next 30 days.

Severity

Scores 9.3 out of 10 (CVSSv4.0). That is remote damage without needing an account.

Your move

If you run any of the 8 products above and cannot patch today, assume it will be targeted and restrict access in the meantime.

Exploitation

Status: Actively exploited (CISA KEV)
Added to KEV: 2026-10-15 · remediation due 2026-10-18
EPSS: 99.48% chance of exploitation in 30 days · 99.94% percentile

Analysis

Public sources, summarised. This is context for your decision. The facts above are the ones to act on.

Source	Adds	Summary
cert.europa.eu Primary	Patch details	CERT-EU gives the complete fixed-version table across all eight products, including Jira Service Management 5.12.40/10.3.26/11.3.12, Jira Software 9.12.40/10.3.26/11.3.12, Bamboo 10.2.24/12.1.12 and Crucible 4.9.15, and advises checking access logs for exploitation signs.
jira.atlassian.com Primary	Patch details	Atlassian's own Bitbucket ticket BSERV-20604 (Resolution: Fixed, Priority: Highest, CVSS 9.3) lists affected versions 10.5.0, 9.4.24, 10.2.7, fixes 9.4.26/10.2.8/10.5.1, notes Bitbucket Cloud is unaffected, and warns end-of-life versions may also be vulnerable.
confluence.atlassian.com Primary	Patch details	Vendor advisory page for the arbitrary file access flaw, pointing to dated Atlassian security bulletins as the official fix source.
cyber.gc.ca Primary 2026-10-06	Timeline	Update 2 (October 15, 2026) states CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities database; Update 1 reported in-the-wild exploitation. Its affected list also cites Crowd 7.1.1 and Bamboo 10.2.4 as fix boundaries, differing from other sources.
nvd.nist.gov Primary	Timeline	NVD record notes the CVE appears in CISA's Known Exploited Vulnerabilities list, confirming active exploitation.
watchtowr.com Research	Workaround	watchTowr's FAQ records that on October 2, 2026 Atlassian attached a rewrite.config mitigation file to the public Jira ticket for Jira Data Center, a non-upgrade workaround, alongside an October 5 advisory and October 15 KEV addition.
github.com Research	Exploit detail	GitHub repository offering a working unauthenticated file-read exploit with path traversal and WEB-INF reading tooling.
greenbone.net Research	Impact	Greenbone states the file read can be escalated to admin account takeover under certain conditions when Crowd SSO is in use, cites EPSS at or above the 78th percentile, and notes it was not yet in CISA KEV as of October 13, 2026.

Vendor references

Published

2026-10-26 12:09 UTC