Atlassian Data Center products let unauthenticated requests read named files
On October 5, 2026, Atlassian published CVE-2026-21589. An unauthenticated attacker who already knows a file's exact path can read that file inside the web root of several self-managed Data Center products. Atlassian rates it critical.