Critical Unauthenticated File Read Flaw in 8 Atlassian Data Center Products

Tue, 06 Oct 2026 17:10:43 +0000

Engineer — Act: CVSS 9.3 with a public GitHub PoC lowers the exploitation bar significantly — unauthenticated reads of known-path files (think web.xml, config files with credentials) in widely-deployed Atlassian Data Center products. Patch all affected self-hosted Atlassian Data Center instances to the latest fixed versions immediately, prioritizing any internet-exposed deployments.
SOC/IR — Plan: No active exploitation confirmed yet (EPSS 0.01, not KEV-listed), but the public PoC makes opportunistic scanning likely soon. Build detections for anomalous unauthenticated HTTP requests to Atlassian application paths matching known static file locations across Jira, Confluence, and related products.
Leader — Skip
Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Data-Center on CuraSec