Atlassian CVE-2026-21589 (unauthenticated file read across eight Data Center products) is added to the CISA Known Exploited Vulnerabilities catalog on or before 2027-01-11.
MET · EXPERIMENTAL
- id
- SO-2026-001
- class
- EVIDENCE_PUBLICATION
- claim
- Atlassian CVE-2026-21589 (unauthenticated file read across eight Data Center products) is added to the CISA Known Exploited Vulnerabilities catalog on or before 2027-01-11.
- issued
- 2026-10-13T12:30:00Z
- probability
- 0.65
- benchmark
- 0.5
- benchmark kind
- ANALYST_PRIOR
- benchmark basis
- Judgment. Registry bases: disclosure-first exploitation attempts median 1 day (n=5); catalog entry median 3 days after advisory for exploited flaws (n=19). Offsetting: no exploitation claim from any source as of issuance; CISA requires evidence, not likelihood.
- adjustment
- 0.15
- resolution rule
- YES if the CISA KEV JSON lists CVE-2026-21589 with dateAdded on or before 2027-01-11.
- admissibility
- Only publications dated after 2026-10-13T12:30Z count; for EVENT-class, only events occurring after that timestamp count. Evidence pre-dating issuance resolves the forecast RETROSPECTIVE_DISCOVERY, not YES.
- exclusions
- Not recorded
- resolves
- 2027-01-11
- status
- MET
- outcome date
- 2026-10-15
- outcome basis
- The CISA catalog lists CVE-2026-21589 with a date added of 15 October 2026, two days after issuance; admissible under the event-date rule.
- brier
- 0.1225
- benchmark brier
- 0.25
- resolution source
- EXTERNAL
- experimental
- true
- false positive cost
- Over-forecast would overstate how often broad unauthenticated flaws reach the catalog without a telemetry source.
- ledger hash
- d11ca11b77653f79
- revision log
- record links