Bitbucket Data Center File Access Flaw Explained

What happened

Atlassian has addressed a file access vulnerability affecting Bitbucket Data Center and other products. Think of it as a document counter that hands over a particular folder to someone who knows exactly what to ask for, without checking their identification. The flaw, CVE-2026-21589, allows a remote attacker without an account to retrieve certain files from an affected application's web root, the directory that holds files used by the web application.

The advisory covers Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. The attacker must already know the exact filename and path. The vulnerability does not provide a way to browse folders or list their contents, but sensitive files may still be exposed in some configurations.

CVE-2026-21589 is known to be exploited: CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-15. NVD published its entry on 2026-10-05 and lists a CRITICAL severity rating. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-30.

Technical details

This is an arbitrary file access vulnerability, meaning an attacker can obtain files that should not be available to them. NVD associates it with CWE-552, Files or Directories Accessible to External Parties. The security failure is that certain application files can be reached by an outside requester without authentication, the process of proving a user's identity. The advisory description does not identify the underlying code defect, so it does not support a more specific explanation of the implementation error.

The attack has a meaningful prerequisite: the requester must know the target file's exact name and path. There is no directory listing capability to reveal available filenames through this vulnerability. Its described scope is specific files within the web application root; that does not establish unrestricted access to every file on the server.

The consequences depend on what files exist in that location and what they contain. A configuration that places sensitive material there may face more serious disclosure than a configuration without such material. The described behavior is file access; it does not by itself establish that an attacker can change files or execute code.

NVD assigns a CVSS score of 9.3 under CVSS version 4.0 and labels the vulnerability CRITICAL. CVSS, the Common Vulnerability Scoring System, expresses technical severity. The score does not show whether a particular installation has been compromised. CISA's KEV listing supplies the separate evidence that exploitation is known to have occurred, while the catalog's ransomware-use field is Unknown.

Who is affected

Everyday users

For everyday users, the practical concern is whether an organization running an affected Atlassian application has sensitive files accessible through this flaw. An attacker does not need a user account, so ordinary sign-in protections alone do not resolve the vulnerable file access behavior. The possible exposure depends on the server's configuration and the files present.

The fix belongs with the team operating the affected application. If you use one of these services through your employer or another organization, ask its support team whether the installation has received the applicable update. This advisory does not establish that your personal information was accessed, and the KEV listing does not mean every affected installation was compromised.

Developers

Developers maintaining affected deployments should pay attention to what their application packaging or deployment process places in the web root. A useful review question is whether any files in that directory contain material that should require authorization to read. The exact-name-and-path requirement limits discovery through this flaw, but it should not be treated as a replacement for access controls.

Keep the investigation aligned with the described behavior: unauthenticated access to specific application files. The advisory description does not establish directory browsing, file modification or code execution. Apply the product update and assess potentially exposed content according to the actual deployment, without assuming that every installation contains the same sensitive files.

Server and IT admins

Server and IT administrators should inventory each affected product and match its installed version to the appropriate fixed release in the vendor advisory. Several products have multiple listed update targets. Treat those as product-specific release choices and confirm the applicable release line before deciding that an installation is fixed; a single comparison against the smallest listed version can be misleading.

Confirmed exploitation makes remediation a priority. The CISA KEV entry lists 2026-10-18 as its due date, but that date should not be presented as a universal deadline for every reader. Track the product update and any investigation of possible file exposure as related tasks: installing a fix addresses the vulnerability, while assessing prior access requires separate evidence.

What to do now

1. Inventory installations of Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. Record each installed version and use the vendor advisory to determine the applicable update target.
2. For Bitbucket Data Center, the listed affected thresholds are earlier than 9.4.26, earlier than 10.2.8 and earlier than 10.5.1. The corresponding fixed versions are 9.4.26 and later, 10.2.8 and later, and 10.5.1 and later. Match the target to the applicable release line.
3. For Confluence Data Center, the listed thresholds and fixes are earlier than 9.2.26 → 9.2.26 and later, and earlier than 10.2.19 → 10.2.19 and later. For Jira Service Management Data Center, they are earlier than 5.12.40 → 5.12.40 and later, earlier than 10.3.26 → 10.3.26 and later, and earlier than 11.3.12 → 11.3.12 and later. For Jira Software Data Center, they are earlier than 9.12.40 → 9.12.40 and later, earlier than 10.3.26 → 10.3.26 and later, and earlier than 11.3.12 → 11.3.12 and later.
4. For Bamboo Data Center, the listed thresholds and fixes are earlier than 10.2.24 → 10.2.24 and later, and earlier than 12.1.12 → 12.1.12 and later. For Crowd Data Center, they are earlier than 6.3.7 → 6.3.7 and later, earlier than 7.0.3 → 7.0.3 and later, earlier than 7.1.7 → 7.1.7 and later, and earlier than 7.2.4 → 7.2.4 and later.
5. For Crucible and Fisheye, versions earlier than 4.9.15 are listed as affected. The listed fix for each product is 4.9.15 and later.
6. Follow the update steps in the vendor's advisory for each affected installation. Prioritize this work based on CISA's confirmation of known exploitation, and confirm that the intended fixed release is actually running after the update.
7. Assess whether sensitive files were present within the affected application's web root. Keep that exposure assessment separate from the update record, and do not interpret successful patching as proof that no earlier access occurred.

If you can't update yet

• If an update must wait, check the vendor advisory for guidance on restricting access to the affected application. Access restrictions are a temporary risk-reduction measure, not confirmation that the flaw is fixed.
• Check the vendor advisory for guidance on reducing internet exposure while remediation is pending. Confirm that any temporary restriction fits the affected deployment.

How to confirm the fix

• Confirm the running product and version after the update, then match them to the applicable fixed release in the vendor advisory. Use the correct release line for products with multiple listed fixes.
• Reconcile the completed updates against the installation inventory so that each affected deployment has a recorded remediation status.
• Follow any verification steps in the vendor's advisory and confirm that the application remains usable for its intended work after updating.
• Document the file-exposure assessment separately. A fixed version confirms remediation of the vulnerable software; it does not establish whether sensitive files were accessed before the update.

NVD scores and CISA KEV status

Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-21589 (added October 15, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.

Affected products and fixed versions 19 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Atlassian advisory: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
• NVD: CVE-2026-21589
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 30, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.