CISA put the Atlassian flaw on its exploited list. The deadline is Sunday.
By Lior AharonovFounder, 7IT Solutions ·
On Thursday, 15 October 2026, CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog, with a federal deadline of 18 October. Atlassian rates the unauthenticated file access flaw 9.3 and lists fixes for Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center. SecurityWeek reports 190 attack attempts from 32 IP addresses by 8 October.
Your Jira and Confluence hold the code, the runbooks and the passwords people pasted into tickets. Public exploit code appeared and attacks followed within hours, no login needed. Atlassian says Cloud is patched but cannot say whether your Data Center was hit.
Upgrade every self-hosted Atlassian product to its fixed release today, for example Jira Software 11.3.12 or Confluence 10.2.19. Then review access logs from 6 October on and rotate the credentials stored in Crowd's properties file.
Data Center means the patch is your job. Nobody at Atlassian is coming to apply it for you on a Sunday.
Lior Aharonov · my takeSources
- Atlassian: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products confluence.atlassian.com
- CISA Known Exploited Vulnerabilities catalog (CSV feed) raw.githubusercontent.com
- SecurityWeek: Attackers target critical Atlassian vulnerability within hours of PoC publication securityweek.com
Researched with AI tools; every fact is checked against the linked sources.