Loading story…
Atlassian published security advisory AV26-731 covering multiple vulnerabilities, including some rated critical, across a broad set of products used in data center, server, and desktop environments. Affected product lines named in follow-on notices include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, Jira Service Management, and Sourcetree for Mac and Windows, and government guidance urged administrators to review the advisories and apply vendor updates.
One of the disclosed issues, CVE-2026-21579, is a high-severity information disclosure flaw in Atlassian Confluence Data Center with a CVSS 4.0 score of 8.2. Atlassian said the vulnerability can be exploited remotely by an unauthenticated attacker to access sensitive information, affects multiple Confluence Data Center release lines, and is fixed in supported versions including 9.2.22 or later and 10.2.14 or later; customers were advised to upgrade to the latest or patched supported releases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published a notice about Atlassian advisory AV26-731 covering multiple vulnerabilities, including some rated critical, across several Atlassian products. The notice urged administrators to review the advisories and apply the necessary updates.
Atlassian disclosed CVE-2026-21579, a high-severity information disclosure vulnerability in Confluence Data Center that can allow unauthenticated remote attackers to view sensitive information. Atlassian said the issue affected multiple release lines and recommended upgrading to fixed supported versions including 9.2.22+ and 10.2.14+.
Atlassian published Jira issue CONFSERVER-104340 describing a high-severity information disclosure vulnerability in Confluence Data Center with CVSS 8.2. The issue affected versions across multiple release lines and advised upgrading to fixed releases including 9.2.22+ and 10.2.14+.
Atlassian published the referenced security advisories page that serves as the vendor source for the disclosed issues.
Atlassian released security updates for Bamboo Data Center and Server, Confluence Data Center and Server, Jira Data Center and Server, and Jira Service Management Data Center and Server to fix 30 vulnerabilities. The bulletin highlighted Bamboo flaws CVE-2024-21687 and CVE-2024-22262 among the most serious issues and provided fixed versions for affected product lines.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecvefeed.io
Open sourcejira.atlassian.com
Open sourceatlassian.com
Open sourcecsirt.sk
Open sourceconfluence.atlassian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian and Finland’s National Cyber Security Centre warned of multiple severe vulnerabilities in Atlassian products, led by **`CVE-2022-1471`**, a critical SnakeYAML deserialization flaw rated **CVSS 9.8** that can enable remote code execution across **Bitbucket, Confluence, Jira Core, Jira Software, Jira Service Management, Automation for Jira,** and the **Confluence Cloud Migration App**. Atlassian said its hosted **`atlassian.net`** cloud sites are not affected, but Data Center and Server deployments face broad exposure and should be upgraded immediately to fixed releases. The advisories also identified product-specific RCE issues in **Confluence Data Center and Server** (**`CVE-2023-22522`**), the **Assets Discovery** app (**`CVE-2023-22523`**), and **Atlassian Companion App for macOS** (**`CVE-2023-22524`**). Authorities urged organizations to install patched versions without delay and, where patching cannot be completed at once, remove vulnerable services from the public internet; Atlassian added that there is no mitigation for some affected products, while certain Jira and Jira Service Management environments can reduce risk by upgrading the **Automation for Jira** app to a fixed version.
Jun 29, 2026
Atlassian disclosed a critical Confluence vulnerability, **`CVE-2023-22515`**, that can let an attacker create unauthorized administrator accounts and potentially take over the entire environment. Atlassian assessed the flaw as likely falling between **9.0 and 10.0** in severity and urged defenders to restrict access to the vulnerable component until patches could be applied. Authorities warned that any internet-exposed vulnerable instance showing even minor anomalies should be treated as potentially compromised, with indicators including unexpected additions to the `confluence-administrators` group, unexplained user creation, requests to `/setup/*.action`, and evidence of `/setup/setupadministrator.action` in `atlassian-confluence-security.log`. Subsequent analysis indicated the flaw might also be exploitable without creating an administrator account, including through `/server-info.action`, and Microsoft reported signs of exploitation dating back to mid-September 2023. JetBrains later released fixes for critical TeamCity authentication bypass vulnerabilities affecting all on-premises server installations through version **`2023.11.3`**, resolving them in **`2023.11.4`**. The company said an unauthenticated attacker could send specially crafted HTTP(S) requests to bypass authentication or gain administrator-level access, and exploitation attempts had already been observed. JetBrains updated and checked its cloud-hosted service, while defenders running on-premises TeamCity were told to patch immediately and review systems for compromise after updating, underscoring the ongoing risk from exposed enterprise collaboration and CI/CD platforms that can be seized through admin-level access flaws.
Jun 29, 2026
Atlassian disclosed a critical OS command injection vulnerability, `CVE-2026-21571`, in Bamboo Data Center and Server that can let an authenticated attacker execute arbitrary operating system commands and potentially fully compromise vulnerable CI/CD servers. The flaw carries a CVSS 4.0 score of **9.4**, requires no user interaction, and affects Bamboo Data Center versions `9.6.0`, `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `11.1.0`, `12.0.0`, and `12.1.0`. Atlassian warned that exploitation could impact confidentiality, integrity, availability, and downstream system security, with added risk to build pipelines, stored credentials, and software supply chains. Atlassian also reported a separate high-severity denial-of-service issue, `CVE-2026-33871`, in the bundled `io.netty:netty-codec-http2` dependency that could be abused for HTTP/2-based service disruption. The company urged organizations to patch immediately by upgrading to fixed releases, including `9.6.25` or later, `10.2.18` or later, and `12.1.6` or later, with `10.2.18 LTS` and `12.1.6 LTS` highlighted as recommended targets. Until upgrades are completed, administrators were advised to review deployed Bamboo versions and restrict network access to Bamboo administrative interfaces as a temporary mitigation.
Jun 29, 2026