Act
active
Critical Unauthenticated File Read Flaw in 8 Atlassian Data Center Products
- Engineer — Act: CVSS 9.3 with a public GitHub PoC lowers the exploitation bar significantly — unauthenticated reads of known-path files (think web.xml, config files with credentials) in widely-deployed Atlassian Data Center products. Patch all affected self-hosted Atlassian Data Center instances to the latest fixed versions immediately, prioritizing any internet-exposed deployments.
- SOC/IR — Plan: No active exploitation confirmed yet (EPSS 0.01, not KEV-listed), but the public PoC makes opportunistic scanning likely soon. Build detections for anomalous unauthenticated HTTP requests to Atlassian application paths matching known static file locations across Jira, Confluence, and related products.
- Leader — Skip
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.