In early October 2026, Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) unauthenticated file-access vulnerability affecting eight of its self-hosted Data Center products, including Jira, Confluence, and Bitbucket. The flaw allows an attacker to read specific files in the web root directory without logging in. Within hours of WatchTowr publishing a technical proof-of-concept, threat actors began actively scanning and exploiting the flaw, primarily aiming to read sensitive configuration f...