CVE-2026-21589
CWE-552
Final Priority
High88.3
Raw RPSRPS range: 0–105; KEV-listed vulnerabilities can receive an exploitation amplifier.
Description
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26…
Source: NVD
Signals
- CVSS
- 7.5
- High · v3.1
- EPSS
- 12.71%
- Probability of exploitation in the next 30 days (FIRST) · Percentile: 96.2%
- CISA KEV
- In CISA KEV since Oct 2026
- Confirmed exploitation in the wild (CISA KEV)
- Upstream fix commit
- No verified fix commit in DevSecure data
- Sources: MoreFixes, FreshFixes
- SSVC inputs (CISA)
- Exploitation: Active · Automatable: No · Technical impact: Total
- CISA's assessed SSVC inputs, not a decision. A decision also needs your mission and public well-being context. Context only; not part of the RPS score.
- Weakness
- CWE-552
- Published
- 5 Oct 2026
- Last modified 19 Oct 2026
How to read these signals: RPS · EPSS · CISA KEV · Data sources
What would change this priority?
- •Stays at least High while it is in CISA KEV (KEV floor).
Explains the published RPS formula and priority rules; it doesn't change the score. How priority works
Get this score from the API
curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
https://api.intelligence.devsecure.io/api/v1/rps/CVE-2026-21589Replace the placeholder with your key. Get a free API key or rank your own CVEs.
Data as of 23 Oct 2026, 05:17 UK time
This product uses the NVD API but is not endorsed or certified by the NVD. Data sources and licences