Atlassian security advisories, September 2026

Every Atlassian security advisory published in September 2026, from Atlassian ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 33
Critical: 6
High: 27
In CISA KEV: 0
CVEs: 33

Atlassian advisories published in September 2026

Sep 15, 2026
Critical [CVE-2026-45674] MITM (Man-in-the-Middle) Netty Dependency in Confluence Data Center
Critical10.0
Sep 15, 2026
Critical [CVE-2026-4800] RCE (Remote Code Execution) lodash Dependency in Bitbucket Data Center
Critical9.8
Sep 15, 2026
Critical [CVE-2026-53434] BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Jira Software Data Center and Server
Critical9.1
Sep 15, 2026
Critical [CVE-2026-55276] BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Confluence Data Center
Critical9.1
Sep 15, 2026
Critical [CVE-2026-59650] Injection Bouncy Castle Dependency in Confluence Data Center
Critical9.3
Sep 15, 2026
Critical [CVE-2026-8763] BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data Center
Critical9.3
Sep 15, 2026
High [CVE-2026-21588] This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center
High7.1
Sep 15, 2026
High [CVE-2026-21587] Confluence: This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center
High7.1
Sep 15, 2026
High [CVE-2026-21586] This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center
High7.1
Sep 15, 2026
High [CVE-2022-46175] Injection json5 Dependency in Jira Software Data Center
High8.8
Sep 15, 2026
High [CVE-2026-12143] RCE (Remote Code Execution) form-data Dependency in Crowd Data Center
High8.7
Sep 15, 2026
High [CVE-2026-12803] BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data Center
High8.7
Sep 15, 2026
High [CVE-2026-13506] DoS (Denial of Service) Bouncy Castle Dependency in Confluence Data Center
High8.7
Sep 15, 2026
High [CVE-2026-14257] DoS (Denial of Service) brace-expansion Dependency in Jira Software Data Center
High7.5
Sep 15, 2026
High [CVE-2026-16221] Injection fast-uri Dependency in Jira Software Data Center
High7.5
Sep 15, 2026
High [CVE-2026-42583] DoS (Denial of Service) io.netty:netty-codec Dependency in Bitbucket Data Center
High7.5
Sep 15, 2026
High [CVE-2026-44249] Improper Authorization io.netty:netty-handler Dependency in Bitbucket Data Center
High8.1
Sep 15, 2026
High [CVE-2026-44728] RCE (Remote Code Execution) @babel/plugin-transform-modules-systemjs Dependency in Jira Software Data Center
High8.2
Sep 15, 2026
High [CVE-2026-45416] DoS (Denial of Service) io.netty:netty-handler Dependency in Bitbucket Data Center
High7.5
Sep 15, 2026
High [CVE-2026-45623] Information Disclosure at postcss Dependency in Bamboo Data Center
High7.5
Sep 15, 2026
High [CVE-2026-47759] DOM-based XSS tinymce Dependency in Jira Software Data Center
High8.7
Sep 15, 2026
High [CVE-2026-48043] DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Confluence Data Center
High7.5
Sep 15, 2026
High [CVE-2026-48801] DoS (Denial of Service) linkify-it Dependency in Jira Service Management Data Center
High8.7
Sep 15, 2026
High [CVE-2026-50010] BASM (Broken Authentication & Session Management) Netty Dependency in Bitbucket Data Center and Server
High7.5
Sep 15, 2026
High [CVE-2026-58060] RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center
High8.7
Sep 15, 2026
High [CVE-2026-59869] DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center
High7.5
Sep 15, 2026
High [CVE-2026-59879] DoS (Denial of Service) immutable Dependency in Confluence Data Center
High8.7
Sep 15, 2026
High [CVE-2026-59880] DoS (Denial of Service) immutable.js Dependency in Confluence Data Center
High8.7
Sep 15, 2026
High [CVE-2026-59901] DoS (Denial of Service) Netty Dependency in Confluence Data Center
High8.7
Sep 15, 2026
High [CVE-2026-67320] Information Disclosure axios Dependency in Jira Software Data Center
High8.3
Sep 15, 2026
High [CVE-2026-73088] DoS (Denial of Service) browserslist Dependency in Jira Software Data Center
High7.5
Sep 15, 2026
High [CVE-2026-73566] DoS (Denial of Service) tar Dependency in Confluence Data Center
High7.5
Sep 15, 2026
High [CVE-2026-75899] SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data Center
High7.5

Get an email when Atlassian publishes the next one.

See Atlassian's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Atlassian

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.