Critical Atlassian RCE Flaws Expose Confluence, Bitbucket, Jira, and Companion App

Atlassian and Finland’s National Cyber Security Centre warned of multiple severe vulnerabilities in Atlassian products, led by CVE-2022-1471, a critical SnakeYAML deserialization flaw rated CVSS 9.8 that can enable remote code execution across Bitbucket, Confluence, Jira Core, Jira Software, Jira Service Management, Automation for Jira, and the Confluence Cloud Migration App. Atlassian said its hosted atlassian.net cloud sites are not affected, but Data Center and Server deployments face broad exposure and should be upgraded immediately to fixed releases.

The advisories also identified product-specific RCE issues in Confluence Data Center and Server (CVE-2023-22522), the Assets Discovery app (CVE-2023-22523), and Atlassian Companion App for macOS (CVE-2023-22524). Authorities urged organizations to install patched versions without delay and, where patching cannot be completed at once, remove vulnerable services from the public internet; Atlassian added that there is no mitigation for some affected products, while certain Jira and Jira Service Management environments can reduce risk by upgrading the Automation for Jira app to a fixed version.