widely-deployed-product-advisoryinternet-facing-service-vulnerability

Atlassian Advisory Warns of Critical Flaws Across Confluence, Jira, Bitbucket and More

Patch & Detection Intelligence · 6 sources · Updated 4mo ago · First seen Jul 22, 2026

Atlassian published security advisory AV26-731 covering multiple vulnerabilities, including some rated critical, across a broad set of products used in data center, server, and desktop environments. Affected product lines named in follow-on notices include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, Jira Service Management, and Sourcetree for Mac and Windows, and government guidance urged administrators to review the advisories and apply vendor updates.

One of the disclosed issues, CVE-2026-21579, is a high-severity information disclosure flaw in Atlassian Confluence Data Center with a CVSS 4.0 score of 8.2. Atlassian said the vulnerability can be exploited remotely by an unauthenticated attacker to access sensitive information, affects multiple Confluence Data Center release lines, and is fixed in supported versions including 9.2.22 or later and 10.2.14 or later; customers were advised to upgrade to the latest or patched supported releases.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Jul 19, 2024 – Jul 21, 2026

Jul 21, 20264mo ago
Canadian Centre for Cyber Security issues notice on Atlassian advisory AV26-731
The Canadian Centre for Cyber Security published a notice about Atlassian advisory AV26-731 covering multiple vulnerabilities, including some rated critical, across several Atlassian products. The notice urged administrators to review the advisories and apply the necessary updates.
Atlassian security advisory (AV26-731) - Malware News - Malware Analysis, News and Indicators
Jul 21, 20264mo ago
Atlassian discloses CVE-2026-21579 in Confluence Data Center
Atlassian disclosed CVE-2026-21579, a high-severity information disclosure vulnerability in Confluence Data Center that can allow unauthenticated remote attackers to view sensitive information. Atlassian said the issue affected multiple release lines and recommended upgrading to fixed supported versions including 9.2.22+ and 10.2.14+.
CVE-2026-21579 - Atlassian Confluence Data Center Information Disclosure Vulnerability
Jul 9, 20264mo ago
Atlassian Jira issue discloses CVE-2026-21579 in Confluence Data Center
Atlassian published Jira issue CONFSERVER-104340 describing a high-severity information disclosure vulnerability in Confluence Data Center with CVSS 8.2. The issue affected versions across multiple release lines and advised upgrading to fixed releases including 9.2.22+ and 10.2.14+.
[CONFSERVER-104340] Information Disclosure in Confluence Data Center - Create and track feature requests for Atlassian products.
May 22, 20266mo ago
Atlassian publishes security advisories page entry
Atlassian published the referenced security advisories page that serves as the vendor source for the disclosed issues.
Security Advisories | Atlassian
Jul 19, 20242y ago
Atlassian releases updates for 30 vulnerabilities across server products
Atlassian released security updates for Bamboo Data Center and Server, Confluence Data Center and Server, Jira Data Center and Server, and Jira Service Management Data Center and Server to fix 30 vulnerabilities. The bulletin highlighted Bamboo flaws CVE-2024-21687 and CVE-2024-22262 among the most serious issues and provided fixed versions for affected product lines.
Zraniteľnosti v serveroch Atlassian | CSIRT.SK

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Information Disclosure in Atlassian Confluence Data Center (CVE-2026-21579)

Affected products

3 linked

Confluence Data CenterCrowd Data Center And ServerConfluence Data Center And Server

Organizations

1 linked

Atlassian

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Malware NewsNews · Jul 22, 2026

Atlassian security advisory (AV26-731) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Cvefeed High SeverityAdvisories · Jul 21, 2026

CVE-2026-21579 - Atlassian Confluence Data Center Information Disclosure VulnerabilityOpen source ↗

Atlassian JiraNews · Jul 9, 2026

[CONFSERVER-104340] Information Disclosure in Confluence Data Center - Create and track feature requests for Atlassian products.Open source ↗

AtlassianNews · May 22, 2026

Security Advisories | AtlassianOpen source ↗

Csirt SkNews · Jul 19, 2024

Zraniteľnosti v serveroch Atlassian | CSIRT.SKOpen source ↗

Atlassian ConfluenceNews

Confluence Release Notes | Confluence Data Center 10.2 | Atlassian DocumentationOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News