Loading story…
Atlassian and Finland’s National Cyber Security Centre warned of multiple severe vulnerabilities in Atlassian products, led by CVE-2022-1471, a critical SnakeYAML deserialization flaw rated CVSS 9.8 that can enable remote code execution across Bitbucket, Confluence, Jira Core, Jira Software, Jira Service Management, Automation for Jira, and the Confluence Cloud Migration App. Atlassian said its hosted atlassian.net cloud sites are not affected, but Data Center and Server deployments face broad exposure and should be upgraded immediately to fixed releases.
The advisories also identified product-specific RCE issues in Confluence Data Center and Server (CVE-2023-22522), the Assets Discovery app (CVE-2023-22523), and Atlassian Companion App for macOS (CVE-2023-22524). Authorities urged organizations to install patched versions without delay and, where patching cannot be completed at once, remove vulnerable services from the public internet; Atlassian added that there is no mitigation for some affected products, while certain Jira and Jira Service Management environments can reduce risk by upgrading the Automation for Jira app to a fixed version.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The December 7 notice specified that only the Assets Discovery add-on was affected by CVE-2023-22523 and that the Windows version of Atlassian Companion App was not affected by CVE-2023-22524. It also highlighted fixed versions for Confluence, Assets Discovery, and Atlassian Companion App for macOS.
On December 7, 2023, Traficom's Kyberturvallisuuskeskus issued a security notice warning about several serious Atlassian vulnerabilities, including CVE-2022-1471 and product-specific RCE flaws CVE-2023-22522, CVE-2023-22523, and CVE-2023-22524. The notice urged organizations to immediately install fixed versions or remove vulnerable services from the public internet until patching could be completed.
In its advisory, Atlassian listed affected products including Bitbucket, Confluence, Jira Core, Jira Software, Jira Service Management, Automation for Jira, and the Confluence Cloud Migration App, and provided fixed versions. It also stated that Jira and Jira Service Management could in some cases be fully mitigated by upgrading the Automation for Jira app, while some other products had no workaround short of upgrading.
On December 5, 2023, Atlassian disclosed CVE-2022-1471, a critical SnakeYAML deserialization vulnerability rated CVSS 9.8 that can lead to remote code execution in multiple Data Center and Server products. Atlassian said Cloud sites hosted on atlassian.net were not affected and urged customers to upgrade immediately, noting limited mitigation options for some products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceconfluence.atlassian.com
Open sourceconfluence.atlassian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian published security advisory `AV26-731` covering multiple vulnerabilities, including some rated **critical**, across a broad set of products used in data center, server, and desktop environments. Affected product lines named in follow-on notices include **Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, Jira Service Management, and Sourcetree** for Mac and Windows, and government guidance urged administrators to review the advisories and apply vendor updates. One of the disclosed issues, `CVE-2026-21579`, is a high-severity **information disclosure** flaw in **Atlassian Confluence Data Center** with a CVSS 4.0 score of **8.2**. Atlassian said the vulnerability can be exploited remotely by an **unauthenticated** attacker to access sensitive information, affects multiple Confluence Data Center release lines, and is fixed in supported versions including **9.2.22 or later** and **10.2.14 or later**; customers were advised to upgrade to the latest or patched supported releases.
Jul 24, 2026
Atlassian disclosed a critical Confluence vulnerability, **`CVE-2023-22515`**, that can let an attacker create unauthorized administrator accounts and potentially take over the entire environment. Atlassian assessed the flaw as likely falling between **9.0 and 10.0** in severity and urged defenders to restrict access to the vulnerable component until patches could be applied. Authorities warned that any internet-exposed vulnerable instance showing even minor anomalies should be treated as potentially compromised, with indicators including unexpected additions to the `confluence-administrators` group, unexplained user creation, requests to `/setup/*.action`, and evidence of `/setup/setupadministrator.action` in `atlassian-confluence-security.log`. Subsequent analysis indicated the flaw might also be exploitable without creating an administrator account, including through `/server-info.action`, and Microsoft reported signs of exploitation dating back to mid-September 2023. JetBrains later released fixes for critical TeamCity authentication bypass vulnerabilities affecting all on-premises server installations through version **`2023.11.3`**, resolving them in **`2023.11.4`**. The company said an unauthenticated attacker could send specially crafted HTTP(S) requests to bypass authentication or gain administrator-level access, and exploitation attempts had already been observed. JetBrains updated and checked its cloud-hosted service, while defenders running on-premises TeamCity were told to patch immediately and review systems for compromise after updating, underscoring the ongoing risk from exposed enterprise collaboration and CI/CD platforms that can be seized through admin-level access flaws.
Jun 29, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including workflow automation tools, web applications, network devices, and desktop software. Notable issues include remote code execution (RCE) flaws in *n8n*, *Lilac-Reloaded for Nagios*, *FileZilla Client*, and *AVideo*, as well as privilege escalation vulnerabilities in products like *Versa SASE Client*, *AspEmail*, and *ActFax*. Several vulnerabilities allow unauthenticated attackers to upload arbitrary files, bypass authentication, or exploit weak session management, potentially leading to full system compromise or unauthorized access to sensitive data. Many of these vulnerabilities have public exploits available, increasing the risk of active exploitation in the wild. Vendors have released patches for several of the affected products, and administrators are strongly advised to update to the latest versions or apply recommended mitigations. The vulnerabilities span a variety of attack vectors, including buffer overflows, improper input validation, insecure file upload mechanisms, and misconfigured authentication endpoints. Organizations should prioritize patching systems exposed to the internet and review access controls to limit the impact of potential exploitation. Immediate attention is warranted for products with critical CVSS scores and those with known public exploits.
Jun 29, 2026