CISA confirms the Atlassian file-read bug is under active attack

CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on 15 October, confirming the Atlassian file-read bug disclosed on 5 October is now being actively exploited.

The flaw is a pre-authentication arbitrary file-read, CVSS 9.3, hitting eight self-hosted Data Center and Server products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. An attacker who already knows a file’s exact path can pull it straight out of the application without logging in. When Atlassian first disclosed it, the company said it had no evidence of exploitation. CISA’s listing says otherwise: federal agencies now have until 18 October to patch under Binding Operational Directive 26-04. Atlassian Cloud was never affected.

Why it matters: these are tools most dev teams self-host somewhere, a code repo, an issue tracker, a wiki, and a pre-auth file-read bug on any of them can leak config files, credentials or source. A week ago this was “patch when you can.” It is now confirmed under attack, and CISA’s own deadline is a useful forcing function even if you’re not a federal agency.

The caveat: CISA’s KEV listing doesn’t name the threat actor or describe how widespread the attacks are, only that exploitation is confirmed.