Will CVE-2026-21589 (Atlassian Jira/Confluence file-access) be added to CISA KEV by Dec 2026?

Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access vulnerability in Jira and Confluence self-hosted Data Center products. Affects Bitbucket as well. Wide deployment in enterprise environments increases likelihood of active exploitation.

Resolution Criteria

Official CISA KEV listing CVE-2026-21589; or documented active exploitation with confirmed proof-of-concept by vendor or reputable security researcher.