Source: isc.sans.edu
On October 5th, Atlassian released patches for multiple products addressing an 'Arbitrary File Access' vulnerability tracked as CVE-2026-21589. The vulnerability allows attackers to read arbitrary files within the web application's directory. This could expose sensitive information such as configuration files. Active scanning for this vulnerability has been detected as of October 7th. The flaw impacts multiple Atlassian products. The vulnerability was publicly disclosed alongside patches, which typically accelerates exploitation attempts. Security teams are advised to apply patches immediately. The scanning activity suggests threat actors are actively probing for unpatched systems.
