Multiple vulnerabilities in Atlassian products (July 27, 2026)

unknownCVE-2026-42041 CVE-2022-37603 CVE-2026-29145 CVE-2026-21577 CVE-2026-44494 CVE-2026-29146

Multiple vulnerabilities have been discovered in Atlassian products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.

CSIRTS triage

vendor: Atlassian Remote code execution Privilege escalation Denial of service

What: Multiple vulnerabilities in Atlassian products allow for remote arbitrary code execution and privilege escalation.
Who is affected: Users of various Atlassian products.
Urgency: Remediation is high urgency due to the potential for remote exploitation and severe impacts.
Action: Check for updates from Atlassian and apply them as soon as possible.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-07-27
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0934/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-420410.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-376032.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 81% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-291450.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-215770.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-444941.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-291468.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 95% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-340430.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2025-627181.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-48002.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 85% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-336710.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-42041	coverage & exploitation status	NVD · CVE.org
CVE-2022-37603	coverage & exploitation status	NVD · CVE.org
CVE-2026-29145	coverage & exploitation status	NVD · CVE.org
CVE-2026-21577	coverage & exploitation status	NVD · CVE.org
CVE-2026-44494	coverage & exploitation status	NVD · CVE.org
CVE-2026-29146	coverage & exploitation status	NVD · CVE.org
CVE-2026-34043	coverage & exploitation status	NVD · CVE.org
CVE-2025-62718	coverage & exploitation status	NVD · CVE.org
CVE-2026-4800	coverage & exploitation status	NVD · CVE.org
CVE-2026-33671	coverage & exploitation status	NVD · CVE.org
CVE-2026-42033	coverage & exploitation status	NVD · CVE.org
CVE-2026-42035	coverage & exploitation status	NVD · CVE.org
CVE-2026-44495	coverage & exploitation status	NVD · CVE.org
CVE-2026-42043	coverage & exploitation status	NVD · CVE.org
CVE-2026-46625	coverage & exploitation status	NVD · CVE.org
CVE-2026-40175	coverage & exploitation status	NVD · CVE.org
CVE-2026-21579	coverage & exploitation status	NVD · CVE.org
CVE-2022-37601	coverage & exploitation status	NVD · CVE.org
CVE-2026-42198	coverage & exploitation status	NVD · CVE.org
CVE-2025-69873	coverage & exploitation status	NVD · CVE.org
CVE-2026-44487	coverage & exploitation status	NVD · CVE.org
CVE-2026-42583	coverage & exploitation status	NVD · CVE.org
CVE-2026-2332	coverage & exploitation status	NVD · CVE.org
CVE-2026-42581	coverage & exploitation status	NVD · CVE.org
CVE-2026-44705	coverage & exploitation status	NVD · CVE.org
CVE-2026-42044	coverage & exploitation status	NVD · CVE.org
CVE-2026-47838	coverage & exploitation status	NVD · CVE.org
CVE-2026-48779	coverage & exploitation status	NVD · CVE.org
CVE-2026-6322	coverage & exploitation status	NVD · CVE.org
CVE-2026-12143	coverage & exploitation status	NVD · CVE.org
CVE-2026-44486	coverage & exploitation status	NVD · CVE.org
CVE-2026-42264	coverage & exploitation status	NVD · CVE.org
CVE-2026-44496	coverage & exploitation status	NVD · CVE.org
CVE-2026-44492	coverage & exploitation status	NVD · CVE.org
CVE-2022-37599	coverage & exploitation status	NVD · CVE.org
CVE-2026-6321	coverage & exploitation status	NVD · CVE.org
CVE-2026-44490	coverage & exploitation status	NVD · CVE.org
CVE-2026-29063	coverage & exploitation status	NVD · CVE.org
CVE-2025-14813	coverage & exploitation status	NVD · CVE.org
CVE-2026-44488	coverage & exploitation status	NVD · CVE.org
CVE-2025-11226	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [mittel] Netty: Mehrere Schwachstellencert-bund
highexploited[UPDATE] [hoch] Apache Tomcat und Tomcat Native: Mehrere Schwachstellencert-bund
high[UPDATE] [hoch] Kiali für Red Hat OpenShift Service Mesh (Axios, Go, Follow-redirects): Mehrere Schwachstellencert-bund
medium[UPDATE] [mittel] PostgreSQL JDBC Driver: Schwachstelle ermöglicht Denial of Servicecert-bund
high[UPDATE] [hoch] Red Hat Enterprise Linux und Satellite (satellite/iop-remediations-rhel9 container image): Meh…cert-bund
high[UPDATE] [hoch] Bouncy Castle BC-JAVA: Mehrere Schwachstellencert-bund
high[NEU] [hoch] IBM MQ Appliance (Axios Node.js): Mehrere Schwachstellencert-bund
high[UPDATE] [hoch] Red Hat Enterprise Linux (Apicurio Registry): Mehrere Schwachstellencert-bund
medium[UPDATE] [mittel] Red Hat OpenShift Container Platform (protobufjs, fast-uri): Mehrere Schwachstellencert-bund
unknownMultiples vulnérabilités dans les produits IBM (11 septembre 2026)cert-fr-avis
highexploited[UPDATE] [hoch] IBM QRadar SIEM: Mehrere Schwachstellencert-bund
high[NEU] [hoch] SAP Patch Day September 2026: Mehrere Schwachstellencert-bund