Heimdall Security Logo

CVE-2026-21589

Vulnérabilité critique dans Bamboo Data Center (Atlassian)

CVSS 9.3 · Critique
EPSS 12.7%
Atlassian•Bamboo Data Center•Versions : Patch version 10.2.19 and later, Patch version 7.0.3 and later, Patch version 10.3.26 and later, Patch version 5.12.40 and later, Patch version 10.2.8 and later, Patch version 7.2.4 and later, Patch version 9.4.26 and later, Patch version 10.2.24 and later, Patch version 7.1.7 and later, Patch version 11.3.12 and later, Patch version 4.9.15 and later, Patch version 10.5.1 and later, Patch version 9.2.26 and later, Patch version 6.3.7 and later, Patch version 9.12.40 and later, All other versions, Patch version 12.1.12 and later

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Gravité et risque d'exploitation

CVE-2026-21589 obtient un score CVSS de 9.3/10, soit une gravité critique. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 12.71 %, ce qui la place devant 96.2 % des CVE référencées.

Que faire ?

  • Vérifiez si Bamboo Data Center (versions Patch version 10.2.19 and later, Patch version 7.0.3 and later, Patch version 10.3.26 and later, Patch version 5.12.40 and later, Patch version 10.2.8 and later, Patch version 7.2.4 and later, Patch version 9.4.26 and later, Patch version 10.2.24 and later, Patch version 7.1.7 and later, Patch version 11.3.12 and later, Patch version 4.9.15 and later, Patch version 10.5.1 and later, Patch version 9.2.26 and later, Patch version 6.3.7 and later, Patch version 9.12.40 and later, All other versions, Patch version 12.1.12 and later) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE