Atlassian warns of a critical file-access flaw in Jira and Confluence

Atlassian disclosed a critical vulnerability, CVE-2026-21589, affecting multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. An unauthenticated attacker may access specific files in an affected application’s web root directory if they know the file’s exact name and path. Atlassian says it currently has no evidence that the vulnerability is being exploited in attacks.