The issue allows an unauthenticated attacker to read specific files located in each product's web application root directory, meaning no login credentials are required to exploit it. There is a notable constraint, however: the attacker must already know the exact name and path of the target file and cannot browse or list the contents of the directory. This limits the scope of what can be accessed but does not reduce the severity rating, since sensitive files with predictable locations could still be exposed.

Key points:

• Affects 8 Atlassian Data Center products hosted by customers themselves
• CVE-2026-21589 is rated 9.3 out of 10
• No authentication is needed to exploit the flaw
• Attackers must know the exact filename and path; directory listing is not possible
• Disclosure occurred on October 5

Administrators running self-hosted Atlassian Data Center deployments should treat this as a priority and review Atlassian's advisory for the affected product list and available fixes.

Source: The Hacker News

Are any of your self-hosted Atlassian Data Center instances potentially exposed, and how are you planning to patch or mitigate?