Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-21589

CVE-2026-21589CRITICAL

Atlassian Bamboo Data Center — This CVE's publication may have been a false positive or a mistake.

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    9.3   .1271   96.2   YES

AFFECTED
  Product                              Versions              Fixed
  Bamboo Data Center                   All other versions –  Patch version 10.2.24 and later
  Bitbucket Data Center                All other versions –  Patch version 10.2.8 and later
  Confluence Data Center               All other versions –  Patch version 10.2.19 and later
  Crowd Data Center                    All other versions –  Patch version 7.2.4 and later
  Crucible Data Center                 All other versions –  Patch version 4.9.15 and later
  Fisheye Data Center                  All other versions –  Patch version 4.9.15 and later
  Jira Service Management Data Center  All other versions –  Patch version 11.3.12 and later
  Jira Software Data Center            All other versions –  Patch version 11.3.12 and later

TIMELINE
  Jan 1   Reserved by atlassian
  Oct 5   Published (CNA: atlassian)
  Oct 7   EXPLOIT PUBLISHED — CVE-2026-21589 (Atlassian Bamboo Data Center). Public exploit reference added.
  Oct 14  EXPLOIT PUBLISHED — CVE-2026-21589 (Atlassian Bamboo Data Center). Public exploit reference added.
  Oct 15  EXPLOIT PUBLISHED — CVE-2026-21589 (Atlassian Bamboo Data Center). Public exploit reference added.
  Oct 15  ADDED TO KEV — CVE-2026-21589 (Atlassian Bamboo Data Center). Remediation due October 18, 2026.
  Oct 16  REJECTED — CVE-2026-21589 (Atlassian Bamboo Data Center). Record withdrawn by the CNA.

CWE-552 · CNA: atlassian · CVSS v4.0 · 10 references · NVD status: Rejected · KEV due October 18, 2026

Description

This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.

Lifecycle

Complete event history — 7 events, chronological
Date	Event	Detail
January 1, 2026	Reserved	Reserved by atlassian
October 5, 2026	Published	Published (CNA: atlassian)
October 7, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-21589 (Atlassian Bamboo Data Center). Public exploit reference added.
October 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-21589 (Atlassian Bamboo Data Center). Public exploit reference added.
October 15, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-21589 (Atlassian Bamboo Data Center). Public exploit reference added.
October 15, 2026	KEV ADDED	ADDED TO KEV — CVE-2026-21589 (Atlassian Bamboo Data Center). Remediation due October 18, 2026.
October 16, 2026	REJECTED	REJECTED — CVE-2026-21589 (Atlassian Bamboo Data Center). Record withdrawn by the CNA.

Affected

Affected products and packages — 8 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Atlassian	Bamboo Data Center	—	All other versions	Patch version 10.2.24 and later
Atlassian	Bitbucket Data Center	—	All other versions	Patch version 10.2.8 and later
Atlassian	Confluence Data Center	—	All other versions	Patch version 10.2.19 and later
Atlassian	Crowd Data Center	—	All other versions	Patch version 7.2.4 and later
Atlassian	Crucible Data Center	—	All other versions	Patch version 4.9.15 and later
Atlassian	Fisheye Data Center	—	All other versions	Patch version 4.9.15 and later
Atlassian	Jira Service Management Data Center	—	All other versions	Patch version 11.3.12 and later
Atlassian	Jira Software Data Center	—	All other versions	Patch version 11.3.12 and later

Weaknesses

CWE-552

References (10)

Authoritative record: CVE-2026-21589 at cve.org

Vendors: atlassian

Weaknesses: CWE-552

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-21589 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.