Hackers exploit critical Atlassian flaw after public PoC release

CVE-2026-21589 affects multiple Atlassian product families, including Jira, Confluence, and Bitbucket. The vulnerability is being used in attacks that do not require authentication, with activity observed hours after a public technical report and proof of concept were released.