CVE-2026-21589: Critical Atlassian File Access

CVE-2026-21589 is a critical (CVSS v4.0 score 9.3) unauthenticated arbitrary file-access vulnerability impacting multiple self-hosted Atlassian products (Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, Fisheye). Attackers who know an exact filename and path within the web root can retrieve files (not execute code); affected versions should be upgraded to listed fixed releases or removed from public exposure, temporary mitigations (WAF/rewrite rules) are provided, and defenders are advised to hunt logs for traversal-like requests; Atlassian reports no confirmed exploitation as of the advisory but public proof-of-concept material exists.