Security Bulletin - March 17 2026

Security Advisories & Bulletins

On this page

Related content

  • No related content found

Still need help?

The Atlassian Community is here for you.

Ask the community

March 2026 Security Bulletin

The vulnerabilities reported in this Security Bulletin include 21 high-severity vulnerabilities which have been fixed in new versions of our products, released in the last month. These vulnerabilities are discovered via our Bug Bounty program, pen-testing processes, and third-party library scans.

To fix all the vulnerabilities impacting your product(s), Atlassian recommends patching your instances to the latest version or one of the Fixed Versions for each product below. The listed Fixed Versions for each product are current as of March 17, 2026 (date of publication); visit the linked product Release Notes for the most up-to-date versions.

NOTE: The vulnerabilities included in monthly Security Bulletins present a lower impact than those published via Critical Security Advisories. Customers can expect to receive those high-priority patches outside of our monthly schedule as necessary.

To search for CVEs or check your product versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.

Released Security Vulnerabilities
Product & Release Notes Affected Versions Fixed Version Vulnerability Summary CVE ID CVSS Severity
Bamboo Data Center and Server
  • 12.1.0 to 12.1.2 (LTS)
  • 12.0.0 to 12.0.2
  • 11.0.0 to 11.0.8
  • 10.2.0 to 10.2.15 (LTS)
  • 10.1.0 to 10.1.1
  • 10.0.0 to 10.0.3
  • 9.6.1 to 9.6.23 (LTS)
  • 12.1.3 (LTS) recommended Data Center Only
  • 10.2.16 (LTS) Data Center Only
  • 9.6.24 (LTS) Data Center Only
RCE (Remote Code Execution) in Bamboo Data Center CVE-2026-21570 8.6 High
Missing XML Validation vulnerability in Apache Struts Dependency in Bamboo Data Center CVE-2025-68493 8.1 High
DoS (Denial of Service) Apache Struts Dependency in Bamboo Data Center CVE-2025-64775 7.1 High
Bitbucket Data Center and Server
  • 10.1.1 to 10.1.4
  • 9.4.16 (LTS)
  • 10.2.0 to 10.2.1 (LTS) recommended Data Center Only
  • 10.1.5 Data Center Only
  • 9.4.17 to 9.4.18 (LTS) Data Center Only
DoS (Denial of Service) semver Dependency in Bitbucket Data Center and Server CVE-2022-25883 7.5 High
Confluence Data Center and Server
  • 10.2.0 to 10.2.6 (LTS)
  • 10.1.0 to 10.1.2
  • 9.5.1 to 9.5.4
  • 9.2.5 to 9.2.14 (LTS)
  • 9.0.1
  • 10.2.7 (LTS) recommended Data Center Only
  • 9.2.15 to 9.2.17 (LTS) Data Center Only
  • 9.0.2 to 9.0.3 Data Center Only
OS Command Injection glob Dependency in Confluence Data Center and Server CVE-2025-64756 7.5 High
Crowd Data Center and Server
  • 7.1.0 to 7.1.3
  • 7.0.0 to 7.0.2
  • 6.3.0 to 6.3.4
  • 6.2.2 to 6.2.6
  • 6.1.3 to 6.1.7
  • 6.0.0 to 6.0.10
  • 5.3.1 to 5.3.8
  • 7.1.5 recommended Data Center Only
  • 6.3.5 Data Center Only
DOM-based XSS react-router-dom Dependency in Crowd Data Center CVE-2026-21884 8.2 High
DOM-based XSS @remix-run/router Dependency in Crowd Data Center CVE-2026-22029 8 High
DoS (Denial of Service) axios Dependency in Crowd Data Center CVE-2026-25639 7.5 High
Fisheye/Crucible
  • 4.9.0 to 4.9.7
  • 4.8.16
  • 4.9.8 recommended
DoS (Denial of Service) com.nimbusds:nimbus-jose-jwt Dependency in Crucible Data Center and Server CVE-2023-52428 7.5 High
Jira Data Center and Server
  • 11.3.0 to 11.3.2 (LTS)
  • 11.2.0 to 11.2.1
  • 11.1.0 to 11.1.1
  • 11.0.0 to 11.0.1
  • 10.7.1 to 10.7.4
  • 10.6.0 to 10.6.1
  • 10.5.0 to 10.5.1
  • 10.4.0 to 10.4.1
  • 10.3.0 to 10.3.17 (LTS)
  • 10.2.0 to 10.2.1
  • 10.1.1 to 10.1.2
  • 10.0.0 to 10.0.1
  • 9.17.0 to 9.17.5
  • 9.16.0 to 9.16.1
  • 9.15.2
  • 11.3.3 (LTS) recommended Data Center Only
  • 10.3.18 (LTS) Data Center Only
Path Traversal node-tar Dependency in Jira Software Data Center CVE-2026-23950 8.8 High
File Inclusion node-tar Dependency in Jira Software Data Center CVE-2026-23745 8.2 High
File Inclusion node-tar Dependency in Jira Software Data Center CVE-2026-24842 8.2 High
DoS (Denial of Service) ua-parser-js Dependency in Jira Software Data Center CVE-2022-25927 7.5 High
DoS (Denial of Service) semver Dependency in Jira Software Data Center and Server CVE-2022-25883 7.5 High
DoS (Denial of Service) glob-parent Dependency in Jira Software Data Center CVE-2020-28469 7.5 High
Jira Service Management Data Center and Server
  • 11.3.0 to 11.3.2 (LTS)
  • 11.2.0 to 11.2.1
  • 11.1.0 to 11.1.1
  • 11.0.0 to 11.0.1
  • 10.7.1 to 10.7.4
  • 10.6.0 to 10.6.1
  • 10.5.0 to 10.5.1
  • 10.4.0 to 10.4.1
  • 10.3.0 to 10.3.17 (LTS)
  • 10.2.0 to 10.2.1
  • 10.1.1 to 10.1.2
  • 10.0.0 to 10.0.1
  • 5.17.0 to 5.17.5
  • 5.16.0 to 5.16.1
  • 5.15.2
  • 5.12.29 to 5.12.33 (LTS)
  • 11.3.3 (LTS) recommended Data Center Only
  • 10.3.18 (LTS) Data Center Only
Path Traversal node-tar Dependency in Jira Service Management Data Center CVE-2026-23950 8.8 High
File Inclusion node-tar Dependency in Jira Service Management Data Center CVE-2026-23745 8.2 High
File Inclusion node-tar Dependency in Jira Service Management Data Center CVE-2026-24842 8.2 High
DoS (Denial of Service) net.minidev:json-smart Dependency in Jira Service Management Data Center and Server CVE-2024-57699 7.5 High
DoS (Denial of Service) ua-parser-js Dependency in Jira Service Management Data Center and Server CVE-2022-25927 7.5 High
DoS (Denial of Service) glob-parent Dependency in Jira Service Management Data Center CVE-2020-28469 7.5 High


Frequently Asked Questions:

  • Why is my Feature Version not listed in a Fixed Version? You may be using an unsupported version and need to patch to the latest version or Long-Term Support (LTS) version.

  • What are the most up-to-date Data Center product versions? You can always check the software download portal or visit the product-specific download pages.

  • I am using an LTS, why is it not listed in the Fixed Versions? Your LTS version may not have been updated yet or a backported fix may not have been feasible. Please see our Security Bug Fix Policy for more information. We recommend upgrading your products to the latest versions. For the latest fixed versions, visit the release notes linked in the vulnerability table.

  • Questions about the bulletin, have feedback? Let us know! Read more about our bulletins and feel free to contribute feedback on our latest Community Post


To search for CVEs or check your products versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.

Last modified on Mar 17, 2026

Was this helpful?

Yes
No
Provide feedback about this article

Related content

  • No related content found
Powered by Confluence and Scroll Viewport.