Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

A critical arbitrary file access vulnerability (CVE-2026-21589, CVSS 9.3) in multiple Atlassian Data Center products lets unauthenticated actors retrieve sensitive files from the webroot when the exact path is known, potentially exposing credentials (e.g., crowd.properties) and enabling administrative compromise; the vendor published patches and mitigations, and telemetry shows active exploitation attempts from three IPs shortly after technical details were released.