Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

A critical vulnerability (CVE-2026-21589) has been disclosed in 8 Atlassian Data Center self-hosted products. The flaw allows unauthenticated attackers to read specific files within each product's web application root directory without any login credentials. Attackers must know the exact file name and path in advance, as directory listing is not possible. Atlassian disclosed the vulnerability on October 5 and rated it 9.3 out of 10 in severity. The flaw affects 8 distinct Atlassian Data Center products. Due to the high severity score and potential for unauthenticated exploitation, organizations running self-hosted Atlassian products are strongly advised to apply patches promptly.