CISA adds critical Atlassian flaw to Known Exploited Vulnerabilities catalog

CISA added CVE-2026-21589 (CVSS 9.3), an arbitrary file access flaw in Atlassian Data Center products, to its Known Exploited Vulnerabilities catalog. The bug affects Bitbucket, Confluence, Jira, Bamboo, Crowd and other products, and U.S. federal agencies must patch it by October 18, 2026.

• CVE-2026-21589 with a CVSS score of 9.3 was added to CISA's KEV catalog
• Affected products include Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye
• Exploitation began in early October, with 15 attempts from Japan and the U.S.
• U.S. federal agencies must remediate the flaw by October 18, 2026