This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Atlassian fixes 45 vulnerabilities in various products
Atlassian fixes 45 vulnerabilities in various products. Atlassian assessed the critical third-party vulnerabilities present as non-critical, given the way they are implemented in its products. The most severe vulnerabilities are described below; the remaining ones can be found at [1] by clicking through the individual advisories. Fixed versions can be found in the links next to each vulnerability.
An unauthenticated remote attacker is able to gain access to internal network content and cloud metadata due to server-side request forgery in Bamboo Data Center [2].
The vulnerability is present in product:
- Bamboo Data Center; >=10.0.0, <10.2.20; >=11.0.0, <12.1.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2026-44492 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 11. 6. 2026.
An unauthenticated remote attacker is able to cause a DoS attack due to improper management of network resources in Confluence Data Center [3].
The vulnerability is present in product:
- Confluence Data Center; >=8.9.0, <9.2.21; >=10.0.0, <10.2.10
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2026-26996 at cve.org, NVD
- CWE-1333: Inefficient Regular Expression Complexity at cwe.mitre.org
The vulnerability was publicly disclosed 19. 2. 2026.
An unauthenticated remote attacker is able to obtain sensitive information due to a data access control flaw in Bamboo Data Center [4].
The vulnerability is present in product:
- Bamboo Data Center; >=10.0.0, <10.2.20; >=11.0.0, <12.1.8
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2026-44487 at cve.org, NVD
- CWE-201: Insertion of Sensitive Information Into Sent Data at cwe.mitre.org
The vulnerability was publicly disclosed 11. 6. 2026.
An unauthenticated remote attacker is able to execute arbitrary code on the server due to unsafe deserialization of data in the react-router library (Framework Mode) used in Jira Software Data Center and Jira Service Management Data Center [5].
The vulnerability is present in products:
- Jira Software Data Center; >=10.3.8, <10.3.14; >=10.7.1, <=11.1.0
- Jira Service Management Data Center; >=10.3.8, <10.3.14; >=10.7.1, <=11.1.0
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-42211 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 2. 6. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 22. 6. 2026.