CVE-2026-21589
This CVE is being exploited. Apply the vendor fix, or take the service off the internet until you can, then check your logs for attempts.
What it is
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Live exploitation on the huntback network (30 days)
Detection
Evidence
Confirmed exploited. Our decoys saw 5 exploitation attempts in the last 14 days; CISA added it to KEV 28 days ago.
Last attempt. 5 attempts on our decoys, 5 in the last 14 days
First exploitation attempt on our decoys
Reported exploited in the wild: CISA ADP SSVC decision: Exploitation active
Added to CISA Known Exploited Vulnerabilities
Published
10 public proof-of-concept repos
3 public detection scripts (scanner or checker), no exploit code
Nuclei detection template available
Observed: our own decoys saw it. Reported: CISA, the vendor or another named source says so. Weaponised: public exploit code or a scanner template exists. Methodology
Questions
Is CVE-2026-21589 being exploited in the wild?
Yes. The huntback decoy network captured 5 exploitation attempts from 5 distinct source IPs; the most recent was on 2026-11-12. It is also in the CISA KEV catalogue.
Can CVE-2026-21589 be detected on the network?
Yes. huntback carries a network signature for CVE-2026-21589, so attempts against a decoy are tagged in real time.
How huntback helps
Deploy a decoy that emulates Bamboo and you will see every attempt at this CVE the moment it lands, with the full payload, the attacker's infrastructure, and any stage-2 loader. Then huntback can scan the attacker back.
Related
NVD record → Browse all CVEs → Live malware and C2 finds → Novel-attack discovery → Deploy a decoy →API
This record, with its evidence timeline, as JSON:
curl -H "X-API-Key: $HUNTBACK_KEY" https://app.huntback.io/api/v1/evidence/CVE-2026-21589