Software vendor Atlassian issued critical security advisories for a high-severity unauthenticated file access vulnerability (CVE-2026-21589, CVSS 9.3) affecting eight self-hosted Data Center and Server products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The directory traversal flaw allows remote, unauthenticated attackers to read sensitive internal files from the web application root if the file path is known. Atlassian patched affected Cloud products, urged self-hosted customers to immediately deploy updated software releases or implement WAF rewrite mitigation rules, and advised taking exposed instances offline if unpatched.