SANS ISC reports scanning linked to the Atlassian arbitrary file access flaw CVE-2026-21589

According to the SANS ISC report, on October 5, 2026 Atlassian published fixes for several products to correct the vulnerability identified as CVE-2026-21589, classified as arbitrary file access. An attacker who exploits the flaw can read arbitrary files in the web application directory. The text warns that this may expose confidential information, such as configuration files. After the fix, SANS ISC observed scanning related to the vulnerability, which indicates that attackers are trying to find instances not yet updated. The original content is a machine translation of a SANS ISC diary, so technical terms and wording should be checked against the source. To verify, consult the official Atlassian advisory and the original SANS ISC diary linked in the feed, and compare the list of affected products and fixed versions with your inventory. If your organization uses Atlassian products, prioritize the update and review access logs for static and configuration files.