Loading story…
Atlassian products including Bamboo, Bitbucket, Confluence, Crowd, Jira, Jira Service Management, and Fisheye/Crucible were flagged by the Canadian Centre for Cyber Security as affected by multiple vulnerabilities, with administrators urged to review Atlassian’s bulletin and apply updates as fixes become available. The affected Crucible range was identified as 4.9.0 through 4.9.12, while Atlassian release documentation shows current supported branches for products such as Crucible 4.9 and Bitbucket Data Center 10.x, underscoring that supported enterprise deployments are in scope.
Atlassian’s product advisories describe a wide mix of high-severity flaws in bundled dependencies, including unauthenticated remote code execution, denial of service, information disclosure, injection, SQL injection, request smuggling, broken authentication, insecure deserialization, and man-in-the-middle weaknesses. Published fixes include Bamboo Data Center 10.2.22+ and 12.1.10+, Bitbucket Data Center 9.4.23+, 10.2.6+, and 10.4.2+, Confluence Data Center 9.2.23+ and 10.2.15+, Crowd Data Center 7.2.2+, and Crucible Server 4.9.13+, with several issues tied to upstream components such as Netty, Spring, Bouncy Castle, Jackson, Axios, PostgreSQL JDBC, Jetty, and Tomcat.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
16 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security stated that, as of August 18, 2026, Atlassian was affected by vulnerabilities across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, and Jira Service Management. The notice specifically listed Fisheye/Crucible versions 4.9.0 through 4.9.12 among affected products and urged administrators to review Atlassian's bulletin and apply updates.
Atlassian published a broad set of Bitbucket Data Center advisories covering information disclosure, DoS, injection, and RCE issues across several dependencies. The notices directed customers to fixed supported releases including 9.4.23+, 10.2.6+, and 10.4.2+, with some earlier fixes noted at 9.4.22+ and 10.2.5+.
Atlassian disclosed a high-severity man-in-the-middle vulnerability affecting Confluence Data Center through a non-Atlassian Tomcat dependency, while assessing its own implementation risk as lower and non-critical. Customers were advised to upgrade to Confluence Data Center 9.2.23+ or 10.2.15+.
Atlassian published additional Bamboo Data Center advisories tied to Bouncy Castle components, including cryptographic-failure and remote-code-execution classifications. These notices continued to recommend upgrading to Bamboo Data Center 10.2.22+ or 12.1.10+.
Atlassian published a large set of Bamboo Data Center advisories covering RCE, DoS, SQL injection, information disclosure, MITM, file inclusion, injection, and cryptographic issues across multiple dependency components. The notices generally directed customers to fixed supported releases including Bamboo Data Center 10.2.22+ and 12.1.10+, with one js-cookie-related issue fixed in 12.1.9+.
Atlassian published several Confluence Data Center advisories covering injection, information disclosure, denial-of-service, and pgJDBC-related issues across multiple supported branches. The notices directed customers to fixed releases including 9.2.23+ and 10.2.15+, with one Micrometer issue fixed in 10.2.14+.
Atlassian disclosed three Crucible Server vulnerabilities affecting the 4.9 line: a broken authentication/session management issue, a jackson-databind issue, and a critical request-smuggling issue in a non-Atlassian dependency. Atlassian advised customers to upgrade to Crucible Server 4.9.13 or later.
Atlassian published a broad set of Crowd Data Center vulnerability advisories covering DoS, information disclosure, injection, insecure deserialization, MITM, improper authorization, BASM, DOM XSS, and RCE issues across multiple dependency components. The notices consistently advised upgrading affected 7.2 deployments to version 7.2.2 or later.
Atlassian disclosed a high-severity man-in-the-middle vulnerability affecting Crucible Server 4.9.0 and later in the 4.9 line, tied to the PostgreSQL JDBC driver. Customers were advised to upgrade to Crucible Server 4.9.12 or later.
Atlassian disclosed a high-severity denial-of-service vulnerability in Bitbucket Data Center tied to the Bouncy Castle bcpg dependency, affecting versions 9.0.1 through 9.6.0. Atlassian advised upgrading, including to Bitbucket Data Center 9.4.22 or later on the 9.4 branch.
Atlassian released Bitbucket Data Center 9.6 as part of its supported release history. The release is later relevant because subsequent 2026 advisories list 9.x versions among affected branches.
Atlassian released Crucible 4.9 with improved project transfer and supported platform changes. This is the release line later referenced as affected by 2026 advisories.
Atlassian released Bitbucket Data Center 10.3. This version is later included in affected-version ranges in August 2026 Bitbucket vulnerability disclosures.
Atlassian released Bitbucket Data Center 10.2 as a Long Term Support release. Later August 2026 advisories cite fixed versions in the 10.2 branch.
Atlassian released Bitbucket Data Center 10.1.1. This version is later listed among affected releases in August 2026 Bitbucket advisories.
Atlassian released Bitbucket Data Center 10.0. This established the 10.x branch later referenced in multiple 2026 vulnerability notices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcejira.atlassian.com
Open sourcejira.atlassian.com
Open sourcejira.atlassian.com
Open sourcejira.atlassian.com
Open sourcejira.atlassian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian published security advisory `AV26-731` covering multiple vulnerabilities, including some rated **critical**, across a broad set of products used in data center, server, and desktop environments. Affected product lines named in follow-on notices include **Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, Jira Service Management, and Sourcetree** for Mac and Windows, and government guidance urged administrators to review the advisories and apply vendor updates. One of the disclosed issues, `CVE-2026-21579`, is a high-severity **information disclosure** flaw in **Atlassian Confluence Data Center** with a CVSS 4.0 score of **8.2**. Atlassian said the vulnerability can be exploited remotely by an **unauthenticated** attacker to access sensitive information, affects multiple Confluence Data Center release lines, and is fixed in supported versions including **9.2.22 or later** and **10.2.14 or later**; customers were advised to upgrade to the latest or patched supported releases.
Jul 24, 2026
Atlassian and Finland’s National Cyber Security Centre warned of multiple severe vulnerabilities in Atlassian products, led by **`CVE-2022-1471`**, a critical SnakeYAML deserialization flaw rated **CVSS 9.8** that can enable remote code execution across **Bitbucket, Confluence, Jira Core, Jira Software, Jira Service Management, Automation for Jira,** and the **Confluence Cloud Migration App**. Atlassian said its hosted **`atlassian.net`** cloud sites are not affected, but Data Center and Server deployments face broad exposure and should be upgraded immediately to fixed releases. The advisories also identified product-specific RCE issues in **Confluence Data Center and Server** (**`CVE-2023-22522`**), the **Assets Discovery** app (**`CVE-2023-22523`**), and **Atlassian Companion App for macOS** (**`CVE-2023-22524`**). Authorities urged organizations to install patched versions without delay and, where patching cannot be completed at once, remove vulnerable services from the public internet; Atlassian added that there is no mitigation for some affected products, while certain Jira and Jira Service Management environments can reduce risk by upgrading the **Automation for Jira** app to a fixed version.
Jun 29, 2026
Atlassian disclosed two high-severity cryptographic failures in **Bamboo Data Center** tied to vulnerable **Bouncy Castle for Java** components, affecting versions `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `12.0.0`, and `12.1.0`. The advisories say an **unauthenticated attacker** could exploit the flaws without user interaction, potentially exposing assets in the environment and causing **high confidentiality impact**. Atlassian assigned both issues a **CVSS 4.0 score of 8.7** and said the defects do not directly affect integrity or availability. One issue involves `org.bouncycastle:bcpkix-jdk18on`, where **CMS AuthenticatedData** content is not properly bound to the MAC when `authAttrs` are present in Bouncy Castle versions before `1.85`; the other affects `org.bouncycastle:bcprov-jdk18on`, where **KCCMBlockCipher** fails to bind the nonce when AAD is absent, enabling cross-nonce AEAD forgery. Atlassian directed customers to upgrade to the latest Bamboo Data Center release or, at minimum, move to fixed supported versions **`10.2.22`** or **`12.1.10`** and later; Atlassian’s release documentation identifies Bamboo `12.1` as the current long-term support line with `12.1.7` previously listed as the latest bug-fix release.
Aug 19, 2026