CVE-2026-21589
Published Oct 5 by Atlassian
Known exploited · CISA KEV
CISA federal remediation date Oct 18
Vulnerabilities & Exploits
FortiGuard says CVE-2026-21589 affects multiple Atlassian Data Center and Server products, letting an unauthenticated remote attacker read specific files in an application's web root if they know the exact path and name. Atlassian published its advisory on October 5, 2026, and says affected installations should be remediated immediately.
The flaw is simple: the application fails to properly restrict access to files under its web root, so a direct request for a known file can return the file itself. That makes exposed configs and other sensitive files the immediate concern, because those contents can feed follow-on attacks even when the server is otherwise untouched.
For internet-facing deployments, the blast radius is shaped by predictable file locations as much as by the presence of the bug itself. Systems that place secrets or useful configuration details where they can be guessed by path inherit the highest exposure until they are fixed.
1 source · 10h ago
Published Oct 5 by Atlassian
Known exploited · CISA KEV
CISA federal remediation date Oct 18
FortiGuard Labs Threat Signals
Threat Signal Report | FortiGuard Labs
What is the Attack?CVE-2026-21589 is a critical arbitrary file access vulnerability affecting multiple Atlassian Data Center and Server products.
originalPart of the PlainSec briefing for 2026-10-16
Every edition of this story: Atlassian file read flaw hits internet-facing servers