Atlassian Urges Immediate Patching After Critical Arbitrary File-Access Flaw
Atlassian has released emergency fixes for a critical arbitrary file access vulnerability that affects eight of its products — including Jira, Confluence, and Bitbucket. Tracked as CVE-2026-21589 with a CVSS score of 9.3, the flaw allows unauthenticated attackers to retrieve specific files from an application’s web root if they can guess the exact path and filename. While the bug does not let attackers enumerate directories, the ability to fetch particular…