{
  "schema_version": 1,
  "generated_at": "2026-10-16T09:53:36.728719Z",
  "source_catalog_version": "2026.10.15",
  "priority_model": "B13-KEV-v1",
  "source": "CISA KEV",
  "enrichment": "FIRST EPSS",
  "changes": {
    "counts": {
      "new": 1,
      "changed": 0,
      "removed": 0,
      "unchanged": 1745
    },
    "new_priority_counts": {
      "critical": 0,
      "high": 0,
      "medium": 1,
      "low": 0
    },
    "changed_priority_counts": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "displayed": {
      "new": 1,
      "changed": 0,
      "removed": 0
    },
    "new_records": [
      {
        "id": "CVE-2026-21589",
        "type": "vulnerability",
        "source": "CISA KEV",
        "vendor": "Atlassian",
        "product": "Multiple Products",
        "title": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
        "description": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.",
        "date_added": "2026-10-15",
        "due_date": "2026-10-18",
        "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
        "ransomware_use": "unknown",
        "notes": "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
        "cwes": [
          "CWE-552"
        ],
        "epss": 0.02777,
        "epss_percentile": 0.86118,
        "epss_date": "2026-10-15",
        "epss_source": "FIRST EPSS",
        "priority": "MEDIUM",
        "priority_reasons": [
          "CISA KEV confirms exploitation in the wild"
        ],
        "priority_model": "B13-KEV-v1"
      }
    ],
    "changed_records": [],
    "removed_ids": []
  }
}