#Atlassian

InSEKurity of the Week (CW41/2026): Atlassian Data Center Pre-Auth Arbitrary File Read (CVE-2026-21589)

One unauthenticated request to Jira, Confluence or Bitbucket reads files out of the webapp root -- including WEB-INF, where crowd.properties can hand over plaintext credentials and, from there, admin on the instance. CVSS 9.3, eight products, all versions, exploitation attempts within hours of the public write-up.