CVE-2026-21589: Critical Pre-Authentication File Read Affects Atlassian Data Center Products

Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) unauthenticated path-traversal vulnerability in the atlassian-plugins-webresource component that permits remote file reads from the application web root across many Data Center products; Atlassian published fixed versions and urged immediate patching, while Imperva telemetry reports concentrated exploitation attempts (notably in Singapore and telecom/ISP targets). The advisory warns that disclosed configuration files (for example crowd.properties) can expose credentials enabling further compromise (including creation of admin accounts), recommends patching or removing instances from public access, hunting access logs for decoded traversal patterns, and rotating credentials if sensitive files were retrieved.