Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Multiple Atlassian products are affected by a files or directories accessible to external parties vulnerability tracked as CVE-2026-21589. The vulnerability impacts Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. An unauthenticated attacker could exploit this flaw to access specific files within the web application root directory. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have been outlined in CISA's BOD 26-04 implementation guidance. The vulnerability is rated High criticality and requires prompt patching across all affected Atlassian Data Center products.