CISA's deadline to fix the CVE-2026-21589 flaw expires today
Atlassian has patches for all eight Data Center products hit by an actively exploited critical flaw; installing them is up to each administrator.
This Sunday is the deadline for U.S. civilian federal agencies to fix the vulnerability CVE-2026-21589, set by CISA, the U.S. cybersecurity agency. CISA added it on October 15 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of ongoing attacks. The flaw itself has not changed since then; what is new today is the deadline.
Atlassian published its advisory on October 5. It describes a critical arbitrary file access flaw, rated 9.3 on the CVSS scale, in the Data Center editions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Data Center editions are the ones each organization hosts on its own servers. Atlassian's cloud products have been fixed and, according to the company, there is no evidence of exploitation there.
| Product | Patched versions |
|---|---|
| Bitbucket | 10.5.1, 10.2.8, 9.4.26 |
| Confluence | 10.2.19, 9.2.26 |
| Jira Software | 11.3.12, 10.3.26, 9.12.40 |
| Jira Service Management | 11.3.12, 10.3.26, 5.12.40 |
| Bamboo | 12.1.12, 10.2.24 |
| Crowd | 7.2.4, 7.1.7, 7.0.3, 6.3.7 |
| Crucible and Fisheye | 4.9.15 |
The versions match across Help Net Security and Infosecurity Magazine, and with the table in Atlassian's security bulletin that our October 7 report checked. This newsroom could not open the bulletin today.
What is known about the exploitation
According to Infosecurity Magazine, VulnCheck, a threat intelligence firm, added it to its catalog on October 7 after seeing attacks against Bamboo Data Center instances. Atlassian, per the same outlet, cannot confirm how many customers were compromised. For those who cannot update right away, the company suggests, according to that outlet, filtering traffic with a web application firewall or with server rewrite rules, and asks administrators to check their instances for signs of intrusion in addition to updating.
CISA called this type of flaw "a frequent attack vector" for malicious actors. Its directive BOD 26-04 binds only U.S. federal civilian agencies, although the agency encourages all organizations to prioritize the catalog. The October 18 deadline comes from the KEV catalog entry and not from the text of the alert that could be read.
Anyone who exploits it can read files on the server without credentials, and the attacks are already happening. An organization in Mexico running these editions faces the same risk that Atlassian and CISA describe. There is still no official answer on whether unsupported Server products are also affected, and no reliable figure for how many instances are exposed on the internet.
