NCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian products
Atlassian has patched vulnerabilities in various products such as Bamboo, Bitbucket, Confluence, Jira, Crowd and Fisheye. The vulnerabilities are located in various third-party products for which updates have previously been released. Atlassian has incorporated these updates into its own products. Malicious actors can exploit the vulnerabilities to cause a Denial-of-Service, execute arbitrary code by injecting scripts or malicious SQL queries and/or manipulate data or gain access to sensitive data. Some vulnerabilities have an originally high CVSS score of 9 or higher and were initially classified as 'critical' by the developers of the vulnerable product. Due to the way Atlassian uses these third-party modules, direct exploitation of these vulnerabilities is less likely, which is why Atlassian rates the risks of exploitation for their products lower. However, due to the large number of patched vulnerabilities, the NCSC recommends prioritizing these updates, particularly on systems that are accessible from public infrastructure.
CSIRTS triage
- What
- Atlassian products have incorporated patches for third-party component vulnerabilities affecting Bamboo, Bitbucket, Confluence, Jira, Crowd, and Fisheye, including RCE, DoS, SQL injection, and data manipulation risks.
- Who is affected
- Deployments of Atlassian Bamboo, Bitbucket, Confluence, Jira, Crowd, and Fisheye using unpatched versions.
- Urgency
- High urgency due to originally critical-rated vulnerabilities; direct exploitation risk is reduced by Atlassian's architecture but defense-in-depth patching is essential.
- Action
- Apply available security updates to all affected Atlassian products.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0325
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2021-449064.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 91% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2022-35171.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 77% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2023-451330.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-148130.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-06030.80% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-23321.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-35050.76% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-48002.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 85% of all EPSS-scored CVEs.
- Elevated exploitation riskCVE-2021-2333721.3% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 97% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-63210.63% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilitiescert-bund
- high[NEW] [high] Red Hat Enterprise Linux (nodejs:24): Multiple vulnerabilitiescert-bund
- high[NEW] [high] Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri,…cert-bund
- medium[UPDATE] [medium] PostgreSQL JDBC Driver: Vulnerability allows Denial of Servicecert-bund
- high[NEW] [high] IBM License Metric Tool: Multiple vulnerabilitiescert-bund
- high[UPDATE] [high] Red Hat Enterprise Linux and Satellite (satellite/iop-remediations-rhel9 container image): Mul…cert-bund
- medium[NEW] [medium] Red Hat OpenShift Container Platform (fast-uri, OpenTelemetry-Go): Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] Red Hat OpenShift Container Platform (protobufjs, fast-uri): Multiple vulnerabilitiescert-bund
- highexploited[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnera…cert-bund
- high[NEW] [high] IBM App Connect Enterprise: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0311 [1.00] [M/H] Vulnerabilities resolved in Oracle Enterprise Managerncsc-nl
- unknownNCSC-2026-0309 [1.00] [M/H] Vulnerabilities resolved in Oracle Communicationsncsc-nl
More from NCSC-NL Advisories
- unknownNCSC-2026-0303 [1.01] [M/H] Vulnerabilities patched in GitLab by GitLab Inc.2026-08-25
- unknownNCSC-2026-0326 [1.00] [M/H] Vulnerabilities patched in Keycloak2026-08-25
- unknownNCSC-2026-0324 [1.00] [M/H] Vulnerability fixed in Zimbra Collaboration Suite2026-08-23
- unknownNCSC-2026-0323 [1.00] [M/H] Vulnerabilities fixed in Cisco Secure Workload2026-08-21
- unknownNCSC-2026-0322 [1.00] [M/H] Vulnerabilities fixed in Splunk Enterprise by Splunk2026-08-21