Atlassian’s critical flaw turns eight enterprise products into one big security problem

Atlassian has disclosed a critical vulnerability, CVE-2026-21589, affecting eight core enterprise data center products. With a severity rating of 9.3, this arbitrary file access flaw allows unauthenticated attackers to read restricted files within web app root directories. Atlassian advises customers to apply immediate patches to the latest fixed versions. While cloud offerings are already patched and show no evidence of exploitation, the company emphasizes that impacted on-premises products require urgent attention to mitigate potential security risks.