Security Bulletin - July 21 2026
July 2026 Security Bulletin
The vulnerabilities reported in this Security Bulletin include 83 high-severity vulnerabilities and 18 critical-severity third-party vulnerabilities, which have been fixed in new versions of our products released in the last month.
CVEs reported in monthly Security Bulletins have been assessed as presenting a non-critical risk to Atlassian customers. Atlassian issues Critical Security Advisories for vulnerabilities that pose an immediate critical risk based on how our products actually use the affected components outside of our monthly Security Bulletin schedule as necessary.
Vulnerabilities are discovered through our Bug Bounty program, pen-testing processes, and third-party library scans.
The increase in reported vulnerabilities this month is attributed to externally coordinated security research and patching activity across several widely-used open-source libraries. These upstream events are reflected in our dependency scanning results and do not indicate a change in Atlassian's own security posture.
INSTRUCTIONS
To fix all the vulnerabilities impacting your product(s), Atlassian recommends patching your instances to the latest version or one of the Fixed Versions for each product below. The listed Fixed Versions for each product are current as of July 21, 2026 (date of publication); visit the linked product Release Notes for the most up-to-date versions.
To search for CVEs or check your product versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.
Released Security Vulnerabilities | ||||||
|---|---|---|---|---|---|---|
Product & Release Notes | Affected Versions | Fixed Version | Vulnerability Summary | CVE ID | CVSS Severity | |
|
| RCE (Remote Code Execution) at lodash dependency in Bamboo Data Center | 9.8 Critical This is a vulnerability in a non-Atlassian Bamboo dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||
RCE (Remote Code Execution) at Apache ActiveMQ dependency in Bamboo Data Center | 8.8 High | |||||
8.7 High | ||||||
8.2 High | ||||||
RCE (Remote Code Execution) at Apache ActiveMQ dependency in Bamboo Data Center | 8.1 High | |||||
Improper Authorization netty Dependency in Bamboo Data Center | 8.1 High | |||||
Information Disclosure at Apache Tomcat dependency in Bamboo Data Center | 7.5 High | |||||
DoS (Denial of Service) at netty-handler Dependency in Bamboo Data Center | 7.5 High | |||||
Improper Verification of Cryptographic Signature at netty-handler dependency in Bamboo Data Center | 7.5 High | |||||
RCE (Remote Code Execution) at axios dependency in Bamboo Data Center | 7 High | |||||
|
| RCE (Remote Code Execution) at 'getobject' version in Bitbucket Data Center | 9.8 Critical This is a vulnerability in a non-Atlassian Bitbucket dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||
Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bitbucket Data Center | 8.9 High | |||||
DoS (Denial of Service) with Netty Dependency in Bitbucket Data Center | 8.7 High | |||||
8.7 High | ||||||
8.7 High | ||||||
8.6 High | ||||||
8.2 High | ||||||
8.2 High | ||||||
8.2 High | ||||||
8.2 High | ||||||
BASM (Broken Authentication & Session Management) in Bitbucket Data Center | 8.1 High | |||||
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Bitbucket Data Center | 7.5 High | |||||
7.5 High | ||||||
7.5 High | ||||||
7.5 High | ||||||
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Bitbucket Data Center | 7.5 High | |||||
7.5 High | ||||||
7.5 High | ||||||
7.5 High | ||||||
7.5 High | ||||||
7.5 High | ||||||
7.5 High | ||||||
7.2 High | ||||||
RCE (Remote Code Execution) grunt Dependency in Bitbucket Data Center | 7.1 High | |||||
7 High | ||||||
7 High | ||||||
|
| SSRF (Server-Side Request Forgery) axios Dependency in Confluence Data Center | 10 Critical This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||
SSRF (Server-Side Request Forgery) axios Dependency in Confluence Data Center | 9.9 Critical This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
RCE (Remote Code Execution) at lodash dependency in Confluence Data Center | 9.8 Critical This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
HTTP Request Smuggling org.eclipse.jetty:jetty-http Dependency in Confluence Data Center | 9.1 Critical This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
Prototype Pollution Axios Dependency in Confluence Data Center | 9.1 Critical This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
SSRF (Server-Side Request Forgery) Axios Dependency in Confluence Data Center | 9 Critical This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
8.7 High | ||||||
RCE (Remote Code Execution) form-data Dependency in Confluence Data Center | 8.7 High | |||||
SSRF (Server-Side Request Forgery) axios Dependency in Confluence Data Center | 8.6 High | |||||
Information Disclosure axios Dependency in Confluence Data Center | 8.2 High | |||||
File Inclusion node-tar Dependency in Confluence Data Center | 8.2 High | |||||
8.2 High | ||||||
8.2 High | ||||||
8.2 High | ||||||
DoS (Denial of Service) serialize-javascript Dependency in Confluence Data Center | 7.5 High | |||||
DoS (Denial of Service) netty Dependency in Confluence Data Center | 7.5 High | |||||
DoS (Denial of Service) axios Dependency in Confluence Data Center | 7.5 High | |||||
DoS (Denial of Service) axios Dependency in Confluence Data Center | 7.5 High | |||||
File Inclusion fast-uri Dependency in Confluence Data Center | 7.5 High | |||||
7.5 High | ||||||
7.5 High | ||||||
DoS (Denial of Service) picomatch Dependency in Confluence Data Center | 7.5 High | |||||
Information Disclosure axios Dependency in Confluence Data Center | 7.5 High | |||||
7.5 High | ||||||
DoS (Denial of Service) io.netty:netty-codec-http Dependency in Confluence Data Center and Server NOTE: We’ve issued updated fixed version guidance for this vulnerability. Please refer to the JAC ticket for more information. | 7.5 High | |||||
7.4 High | ||||||
7.4 High | ||||||
7.1 High | ||||||
RCE (Remote Code Execution) axios Dependency in Confluence Data Center | 7 High | |||||
7 High | ||||||
|
| RCE (Remote Code Execution) c3p0 Dependency in Crowd Data Center | 8.9 High | |||
|
| RCE (Remote Code Execution) com.google.protobuf:protobuf-java Dependency in Crucible Server | 8.7 High | |||
DoS (Denial of Service) com.google.protobuf:protobuf-java Dependency in Crucible Server | 7.5 High | |||||
DoS (Denial of Service) com.google.protobuf:protobuf-java Dependency in Crucible Server | 7.5 High | |||||
DoS (Denial of Service) com.google.protobuf:protobuf-java Dependency in Crucible Server | 7.5 High | |||||
|
| Prototype pollution vulnerability parseQuery dependency in Jira Software Data Center | 9.8 Critical This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Software Data Center | 9.8 Critical This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
Cryptographic Failure org.bouncycastle:bcprov Dependency in Jira Software Data Center | 9.3 Critical This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
BASM (Broken Authentication & Session Management) in Jira Software Data Center | 9.1 Critical This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
Prototype Pollution "Gadget" Axios Dependency in Jira Software Data Center | 9.1 Critical This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
Injection Immutable.js Dependency in Jira Software Data Center | 8.7 High | |||||
File Inclusion node-tmp Dependency in Jira Software Data Center | 7.7 High | |||||
Information Disclosure Apache Tomcat Dependency in Jira Software Data Center | 7.5 High | |||||
DoS (Denial of Service) loader-utils Dependency in Jira Software Data Center | 7.5 High | |||||
DoS (Denial of Service) loader-utils Dependency in Jira Software Data Center | 7.5 High | |||||
File Inclusion fast-uri Dependency in Jira Software Data Center | 7.5 High | |||||
7.5 High | ||||||
DoS (Denial of Service) pgjdbc Dependency in Jira Software Data Center | 7.5 High | |||||
DoS (Denial of Service) ajv Dependency in Jira Software Data Center | 7.5 High | |||||
|
| Prototype pollution vulnerability parseQuery dependency in Jira Software Data Center | 9.8 Critical This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Service Management Data Center | 9.8 Critical This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
Cryptographic Failure org.bouncycastle:bcprov Dependency in Jira Service Management Data Center | 9.3 Critical This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
BASM (Broken Authentication & Session Management) in Jira Service Management Data Center | 9.1 Critical This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
Prototype Pollution "Gadget" Axios Dependency in Jira Service Management Data Center | 9.1 Critical This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. | |||||
Injection Immutable.js Dependency in Jira Service Management Data Center | 8.7 High | |||||
8.1 High | ||||||
File Inclusion node-tmp Dependency in Jira Service Management Data Center | 7.7 High | |||||
Information Disclosure Apache Tomcat Dependency in Jira Service Management Data Center | 7.5 High | |||||
File Inclusion fast-uri Dependency in Jira Service Management Data Center | 7.5 High | |||||
DoS (Denial of Service) ajv Dependency in Jira Service Management Data Center | 7.5 High | |||||
DoS (Denial of Service) loader-utils Dependency in Jira Service Management Data Center | 7.5 High | |||||
DoS (Denial of Service) loader-utils Dependency in Jira Service Management Data Center | 7.5 High | |||||
DoS (Denial of Service) pgjdbc Dependency in Jira Service Management Data Center | 7.5 High | |||||
Injection fast-uri Dependency in Jira Service Management Data Center | 7.5 High | |||||
|
| RCE (Remote Code Execution) in Sourcetree for Mac and Sourcetree for Windows | 7.1 High | |||
|
| RCE (Remote Code Execution) in Sourcetree for Mac and Sourcetree for Windows | 7.1 High | |||
Frequently Asked Questions:
Why is my Feature Version not listed in a Fixed Version? You may be using an unsupported version and need to patch to the latest version or Long-Term Support (LTS) version.
What are the most up-to-date Data Center product versions? You can always check the software download portal or visit the product-specific download pages.
I am using an LTS, why is it not listed in the Fixed Versions? Your LTS version may not have been updated yet or a backported fix may not have been feasible. Please see our Security Bug Fix Policy for more information. We recommend upgrading your products to the latest versions. For the latest fixed versions, visit the release notes linked in the vulnerability table.
Questions about the bulletin, have feedback? Let us know! Read more about our bulletins and feel free to contribute feedback on our latest Community Post
To search for CVEs or check your products versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.