CISA Adds Atlassian Multiple Products File-Access Vulnerability to KEV

What's on the official record

CISA added CVE-2026-21589, "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability," to the Known Exploited Vulnerabilities Catalog on 15 October 2026, with a remediation due date of 18 October 2026 for federal civilian agencies. The catalog version is 2026.10.21. The vulnerability (CWE-552) affects eight Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. The record names no fixed version and directs remediation to the vendor advisory. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.127 probability of exploitation (96th percentile, 23 October 2026). CISA's ADP SSVC assessment records exploitation as active, automatable as no, and impact as total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any of the eight named Atlassian Data Center products run in your estate and whether the vendor advisory's mitigations have been applied. The catalog's due date of 18 October 2026 marks the federal remediation window, and the record names no fixed version, so the check is against the vendor advisory rather than a specific release. Decide whether to patch or isolate affected instances until the advisory's mitigations are in place.

For a cyber underwriter, the record lets you check whether a policyholder's estate includes any of the eight named Atlassian Data Center products and whether the vendor advisory's mitigations are applied. CISA's ADP records active exploitation with total impact, which bears on pricing or a control requirement for accounts running these products. The catalog does not record known ransomware use, so ransomware exposure is not established by this record.

What would change this call

A named fixed version in the CVE record would turn the remediation check from a vendor-advisory review into a version comparison. A change in the catalog's ransomware field, or a CISA update to the SSVC exploitation or automatable values, would change the exposure picture for underwriters.

What to check next

Confidence

Filed 25 October 2026 from the record dated 15 October 2026. The note is drawn from a single deterministic collector row copied from the CISA KEV catalog, with the CVE record and NVD as the linked references.

Sources

[1] Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-21589

[2] CVE record CVE-2026-21589 — https://www.cve.org/CVERecord?id=CVE-2026-21589

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog