Atlassian’s Known-File Heist

CVE-2026-21589 lets unauthenticated attackers read known files from eight self-hosted Atlassian product families; in some Crowd-linked Jira deployments, exposed credentials can enable admin access. Patch now, restrict external access until fixed, and review logs.