Critical Flaw in Multiple Atlassian Products Exploited in the Wild

A critical CVE-2026-21589 vulnerability in the Atlassian Web Resource framework allows unauthenticated attackers to perform arbitrary file reads across eight Atlassian Data Center products (including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye). Security researchers (WatchTowr) demonstrated how the flaw can expose Crowd credentials and lead to privilege escalation, and VulnCheck reported exploitation activity targeting Bamboo; Atlassian released patched versions and temporary WAF/Tomcat/urlrewrite mitigations and urged customers to patch or inspect instances for compromise.