Summary
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
- Vendor
- Atlassian
- Product
- Multiple Products
- Added to KEV
- Oct 15, 2026
- Remediation due
- Oct 18, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-552
- EPSS
- 99.7% as of Nov 10
In the news · last mention Oct 12
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References