# Atlassian CVE-2026-21589 (unauthenticated file read across eight Data Center products) is added to the CISA Known Exploited Vulnerabilities catalog on or before 2027-01-11.

- **Artifact ID:** SO-2026-001
- **Status:** MET
- **Public record:** https://record.cybersecurityhq.com/forecasts/so-2026-001
- **Machine-record SHA-256:** `ba8c7c1151945d1f37b35267b18d516212fb4dc944c3e28f321e450dcf43f48d`

## Complete structured record

```json
{
  "id": "SO-2026-001",
  "class": "EVIDENCE_PUBLICATION",
  "claim": "Atlassian CVE-2026-21589 (unauthenticated file read across eight Data Center products) is added to the CISA Known Exploited Vulnerabilities catalog on or before 2027-01-11.",
  "issued": "2026-10-13T12:30:00Z",
  "probability": 0.65,
  "benchmark": 0.5,
  "benchmark_kind": "ANALYST_PRIOR",
  "benchmark_basis": "Judgment. Registry bases: disclosure-first exploitation attempts median 1 day (n=5); catalog entry median 3 days after advisory for exploited flaws (n=19). Offsetting: no exploitation claim from any source as of issuance; CISA requires evidence, not likelihood.",
  "adjustment": 0.15,
  "resolution_rule": "YES if the CISA KEV JSON lists CVE-2026-21589 with dateAdded on or before 2027-01-11.",
  "admissibility": "Only publications dated after 2026-10-13T12:30Z count; for EVENT-class, only events occurring after that timestamp count. Evidence pre-dating issuance resolves the forecast RETROSPECTIVE_DISCOVERY, not YES.",
  "exclusions": null,
  "resolves": "2027-01-11",
  "status": "MET",
  "outcome_date": "2026-10-15",
  "outcome_basis": "The CISA catalog lists CVE-2026-21589 with a date added of 15 October 2026, two days after issuance; admissible under the event-date rule.",
  "brier": 0.1225,
  "benchmark_brier": 0.25,
  "resolution_source": "EXTERNAL",
  "experimental": true,
  "false_positive_cost": "Over-forecast would overstate how often broad unauthenticated flaws reach the catalog without a telemetry source.",
  "ledger_hash": "d11ca11b77653f79",
  "revision_log": [],
  "record_links": []
}
```