Atlassian warns of critical file-access flaw as attackers begin exploitation
Atlassian’s CVE-2026-21589 affects multiple self-hosted Data Center products, including Jira, Confluence, and Bitbucket, and allows arbitrary or specific-file access. Multiple reports say exploitation has begun; one describes attacks as unauthenticated, while another says access requires knowing a file’s exact name and path and does not allow directory listing.