Critical Atlassian flaw lets unauthenticated attackers read known files across eight products

A critical vulnerability in eight self-hosted Atlassian Data Center products allows an attacker with no login access to read specific files in a product's web application root directory. The attacker must know the file's exact name and path and cannot list the directory contents. Atlassian assigned CVE-2026-21589 a score of 9.3 out of 10.