Vulnerability
CVE identifier for a path traversal vulnerability allowing unauthenticated reading of known files in several Atlassian self-hosted products.
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
Atlassian rates CVE-2026-21589 critical at CVSS 4.0 9.3, a no-login file-read flaw in every version of eight self-hosted products. Honeypots saw exploitation attempts by October 6, a day after the advisory, according to a dev.to write-up that found no public report of confirmed victims.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
Atlassian disclosed CVE-2026-21589, a 9.3-rated unauthenticated file-read flaw affecting all eight of its self-hosted Data Center products. A public proof of concept drew exploitation attempts within two hours of landing on 7 October.
Reality
Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishersReality