Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) path traversal flaw in eight self-hosted Data Center products that permits unauthenticated attackers who know exact file paths to read files from the web application root. Atlassian published fixed versions for each product, cloud instances are patched, and temporary mitigations (WAF rules, Tomcat RewriteValve, urlrewrite.xml) are provided for customers who cannot immediately upgrade; customers are advised to restrict public access and search logs for exploitation attempts.