Atlassian Vulnerability Comes Under Attack Hours After Details Go Public

Atlassian Data Center products are being actively exploited via CVE-2026-21589, a critical (CVSS 9.3) arbitrary file access vulnerability where double-colon (::) sequences are treated as path separators and allow unauthenticated reads of webroot files. Researchers and telemetry observed exploitation attempts within hours of technical details being published, including credential exposure and creation of administrative users in at least one instance; Atlassian published fixed versions and recommended mitigations (remove instances from the public internet, WAF/Tomcat rules, temporary fixes) and watchTowr released a scanning tool.