Multiple vulnerabilities in Atlassian products (July 27, 2026)
Multiple vulnerabilities have been discovered in Atlassian products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
CSIRTS triage
- What
- Multiple vulnerabilities in Atlassian products allow for remote arbitrary code execution and privilege escalation.
- Who is affected
- Users of various Atlassian products.
- Urgency
- Remediation is high urgency due to the potential for remote exploitation and severe impacts.
- Action
- Check for updates from Atlassian and apply them as soon as possible.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0934/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-420410.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all scored CVEs.
- Moderate exploitation riskCVE-2022-376032.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 80% of all scored CVEs.
- Low exploitation riskCVE-2026-291450.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
- Low exploitation riskCVE-2026-215770.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all scored CVEs.
- Moderate exploitation riskCVE-2026-444941.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all scored CVEs.
- Moderate exploitation riskCVE-2026-291466.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 93% of all scored CVEs.
- Low exploitation riskCVE-2026-340430.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
- Moderate exploitation riskCVE-2025-627181.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all scored CVEs.
- Moderate exploitation riskCVE-2026-48002.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 84% of all scored CVEs.
- Low exploitation riskCVE-2026-336710.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] IBM App Connect Enterprise: Multiple vulnerabilitiescert-bund
- high[NEW] [high] IBM DataPower Gateway: Multiple vulnerabilitiescert-bund
- unknownMultiples vulnérabilités dans les produits IBM (31 juillet 2026)cert-fr-avis
- high[UPDATE] [high] Kiali for Red Hat OpenShift Service Mesh (Axios, Go, Follow-redirects): Multiple vulnerabiliti…cert-bund
- high[NEW] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: Mul…cert-bund
- high[UPDATE] [high] Red Hat Enterprise Linux and Satellite (satellite/iop-remediations-rhel9 container image): Mul…cert-bund
- high[UPDATE] [high] Red Hat Ansible Automation Platform: Multiple vulnerabilitiescert-bund
- high[UPDATE] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: …cert-bund
- medium[UPDATE] [medium] Red Hat OpenShift Container Platform (protobufjs, fast-uri): Multiple vulnerabilitiescert-bund
- high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] Apache Tomcat and Tomcat Native: Multiple vulnerabilitiescert-bund
- high[UPDATE] [high] Bouncy Castle BC-JAVA: Multiple vulnerabilitiescert-bund
Recent advisories for Atlassian products
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
More from CERT-FR Avis de sécurité
- unknownMultiples vulnérabilités dans le noyau Linux d'Ubuntu (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans le noyau Linux de SUSE (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans le noyau Linux de Red Hat (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans Progress MOVEit Transfer (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans le noyau Linux de Debian LTS (31 juillet 2026)2026-07-31