Security Bulletin - September 15 2026

Security Advisories & Bulletins

On this page

Related content

  • No related content found

Still need help?

The Atlassian Community is here for you.

Ask the community

September 2026 Security Bulletin

The vulnerabilities reported in this Security Bulletin include 144 high-severity vulnerabilities and 17 critical-severity third-party vulnerabilities, which have been fixed in new versions of our products released in the last month.

CVEs reported in monthly Security Bulletins have been assessed as presenting a non-critical risk to Atlassian customers. Atlassian issues Critical Security Advisories for vulnerabilities that pose an immediate critical risk based on how our products actually use the affected components outside of our monthly Security Bulletin schedule as necessary.

Vulnerabilities are discovered through our Bug Bounty program, pen-testing processes, and third-party library scans.

INSTRUCTIONS

To fix all the vulnerabilities impacting your product(s), Atlassian recommends patching your instances to the latest version or one of the Fixed Versions for each product below. The listed Fixed Versions for each product are current as of September 15, 2026 (date of publication); visit the linked product Release Notes for the most up-to-date versions.

To search for CVEs or check your product versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.

Released Security Vulnerabilities
Product & Release NotesAffected VersionsFixed VersionVulnerability SummaryCVE IDCVSS Severity
Bamboo Data Center and Server
  • 12.1.0 to 12.1.10 (LTS)
  • 12.0.0 to 12.0.2
  • 11.0.0 to 11.0.8
  • 10.2.0 to 10.2.22 (LTS)
  • 10.1.0 to 10.1.1
  • 10.0.2 to 10.0.3
  • 12.1.11 (LTS) recommended Data Center Only
  • 10.2.23 (LTS) Data Center Only
RCE (Remote Code Execution) at io.netty dependency in Bamboo Data CenterCVE-2026-75595

9.1 Critical

This is a vulnerability in a non-Atlassian Bamboo dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

DoS (Denial of Service) at tools.jackson.core:jackson-databind Dependency in Bamboo Data CenterCVE-2026-545128.1 High
RCE (Remote Code Execution) at jackson-databind Dependency in Bamboo Data CenterCVE-2026-545138.1 High
Information Disclosure at postcss Dependency in Bamboo Data CenterCVE-2026-456237.5 High
DoS (Denial of Service) at io.netty:netty-codec Dependency in Bamboo Data CenterCVE-2026-735077.5 High
DoS (Denial of Service) at org.apache.tomcat:tomcat-coyote Dependency in Bamboo Data CenterCVE-2026-687637.5 High
File Inclusion at postcss Dependency in Bamboo Data CenterCVE-2026-736467.5 High
BASM (Broken Authentication & Session Management) at Apache Tomcat Dependency in Bamboo Data CenterCVE-2026-534047.3 High
DoS (Denial of Service) at com.mchange:mchange-commons-java Dependency in Bamboo Data CenterCVE-2026-551537.1 High
Bitbucket Data Center and Server
  • 10.4.1
  • 10.3.0 to 10.3.2
  • 10.2.0 to 10.2.5 (LTS)
  • 10.1.1 to 10.1.5
  • 10.0.0 to 10.0.2
  • 9.6.0 to 9.6.5
  • 9.5.0 to 9.5.2
  • 9.4.0 to 9.4.23 (LTS)
  • 9.3.0 to 9.3.2
  • 9.2.0 to 9.2.1
  • 10.4.2 to 10.4.3 Data Center Only
  • 10.2.6 to 10.2.7 (LTS) recommended Data Center Only
  • 9.4.24 (LTS) Data Center Only
BASM (Broken Authentication & Session Management) in Bitbucket Data CenterCVE-2026-215828.8 High
RCE (Remote Code Execution) lodash Dependency in Bitbucket Data CenterCVE-2026-48008.1 High
Improper Authorization io.netty:netty-handler Dependency in Bitbucket Data CenterCVE-2026-442498.1 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data CenterCVE-2026-761727.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data CenterCVE-2026-759757.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data CenterCVE-2026-758997.5 High
BASM (Broken Authentication & Session Management) Netty Dependency in Bitbucket Data Center and ServerCVE-2026-500107.5 High
DoS (Denial of Service) io.netty:netty-handler Dependency in Bitbucket Data CenterCVE-2026-454167.5 High
DoS (Denial of Service) io.netty:netty-codec Dependency in Bitbucket Data CenterCVE-2026-425837.5 High
CSRF (Cross-Site Request Forgery) nanoid Dependency in Bitbucket Data CenterCVE-2026-730867.4 High
Confluence Data Center and Server
  • 10.2.0 to 10.2.15 (LTS)
  • 10.1.0 to 10.1.2
  • 10.0.2 to 10.0.3
  • 9.5.1 to 9.5.4
  • 9.4.0 to 9.4.1
  • 9.3.1 to 9.3.2
  • 9.2.0 to 9.2.23 (LTS)
  • 9.1.0 to 9.1.1
  • 8.9.7 to 8.9.8
  • 8.5.16 to 8.5.31 (LTS)
  • 7.19.28 to 7.19.30 (LTS)
  • 10.2.17 to 10.2.18 (LTS) recommended Data Center Only
  • 9.2.24 to 9.2.25 (LTS) Data Center Only
MITM (Man-in-the-Middle) Netty Dependency in Confluence Data CenterCVE-2026-45674

10 Critical

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

MITM (Man-in-the-Middle) Netty Dependency in Confluence Data CenterCVE-2026-47691

10 Critical

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

RCE (Remote Code Execution) at lodash dependency in Confluence Data CenterCVE-2026-4800

9.8 Critical

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

Injection Bouncy Castle Dependency in Confluence Data CenterCVE-2026-59650

9.3 Critical

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data CenterCVE-2026-8763

9.3 Critical

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Confluence Data CenterCVE-2026-55276

9.1 Critical

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Confluence Data CenterCVE-2026-567458.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data CenterCVE-2026-128038.7 High
DoS (Denial of Service) immutable.js Dependency in Confluence Data CenterCVE-2026-598808.7 High
DoS (Denial of Service) Netty Dependency in Confluence Data CenterCVE-2026-599018.7 High
DoS (Denial of Service) immutable Dependency in Confluence Data CenterCVE-2026-598798.7 High
Broken Authentication & Session Management org.bouncycastle:bcpkix-lts8on Dependency in Confluence Data CenterCVE-2026-128028.7 High
DoS (Denial of Service) Bouncy Castle Dependency in Confluence Data CenterCVE-2026-135068.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data CenterCVE-2026-596428.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data CenterCVE-2026-596398.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data CenterCVE-2026-128168.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Confluence Data CenterCVE-2026-146828.7 High
DoS (Denial of Service) Bouncy Castle Dependency in Confluence Data CenterCVE-2026-580598.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Confluence Data CenterCVE-2026-580608.7 High
Improper Authorization io.netty:netty-handler Dependency in Confluence Data CenterCVE-2026-442498.1 High
DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Confluence Data CenterCVE-2026-480437.5 High
DoS (Denial of Service) tar Dependency in Confluence Data CenterCVE-2026-735667.5 High
DoS (Denial of Service) io.netty:netty-handler Dependency in Confluence Data CenterCVE-2026-454167.5 High
DoS (Denial of Service) io.netty:netty-codec Dependency in Confluence Data CenterCVE-2026-735077.5 High
DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Confluence Data CenterCVE-2026-568197.5 High
BASM (Broken Authentication & Session Management) Netty Dependency in Confluence Data CenterCVE-2026-500107.5 High
DoS (Denial of Service) io.netty:netty-codec-http Dependency in Confluence Data CenterCVE-2026-558337.5 High
DoS (Denial of Service) io.netty:netty-codec-http Dependency in Confluence Data CenterCVE-2026-558317.5 High
CSRF (Cross-Site Request Forgery) nanoid Dependency in Confluence Data CenterCVE-2026-730867.4 High
BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Confluence Data CenterCVE-2026-534047.3 High
Crowd Data Center and Server
  • 7.2.0 to 7.2.2
  • 7.1.0 to 7.1.5
  • 7.0.0 to 7.0.2
  • 6.3.0 to 6.3.6
  • 6.2.0 to 6.2.6
  • 6.1.0 to 6.1.7
  • 7.2.3 recommended Data Center Only
DoS (Denial of Service) Apache Tomcat Dependency in Crowd Data Center and ServerCVE-2026-580598.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Crowd Data Center and ServerCVE-2026-128038.7 High
RCE (Remote Code Execution) form-data Dependency in Crowd Data CenterCVE-2026-121438.7 High
DoS (Denial of Service) Apache Tomcat Dependency in Crowd Data Center and ServerCVE-2026-135068.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Crowd Data Center and ServerCVE-2026-596398.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Crowd Data Center and ServerCVE-2026-596428.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Crowd Data CenterCVE-2026-580608.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Crowd Data CenterCVE-2026-146828.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Crowd Data Center and ServerCVE-2026-128028.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Crowd Data Center and ServerCVE-2026-128168.7 High
DoS (Denial of Service) nanoid Dependency in Crowd Data Center and ServerCVE-2026-672148.2 High
DoS (Denial of Service) nanoid Dependency in Crowd Data Center and ServerCVE-2026-672138.2 High
File Inclusion postcss Dependency in Crowd Data CenterCVE-2026-736467.5 High
DoS (Denial of Service) io.netty:netty-codec Dependency in Crowd Data CenterCVE-2026-735077.5 High
CSRF (Cross-Site Request Forgery) nanoid Dependency in Crowd Data CenterCVE-2026-730867.4 High
BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Crowd Data Center and ServerCVE-2026-534047.3 High
Fisheye/Crucible
  • 4.9.0 to 4.9.13
  • 4.9.14 recommended
BASM (Broken Authentication & Session Management) at Bouncy Castle Dependency in Crucible Data Center and ServerCVE-2026-8763

9.3 Critical

This is a vulnerability in a non-Atlassian Fisheye/Crucible dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

Injection at org.bouncycastle:bcprov-jdk18on Dependency in Crucible ServerCVE-2026-59650

9.3 Critical

This is a vulnerability in a non-Atlassian Fisheye/Crucible dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

RCE (Remote Code Execution) at org.bouncycastle:bcprov-jdk18on Dependency in Crucible ServerCVE-2026-580608.7 High
RCE (Remote Code Execution) at org.bouncycastle:bcprov-jdk18on Dependency in Crucible ServerCVE-2026-146828.7 High
DoS (Denial of Service) at org.bouncycastle:bcprov-jdk18on in Crucible ServerCVE-2026-580598.7 High
BASM (Broken Authentication & Session Management) at Bouncy Castle Dependency in Crucible ServerCVE-2026-128168.7 High
BASM (Broken Authentication & Session Management) at Bouncy Castle Dependency in Crucible ServerCVE-2026-128038.7 High
BASM (Broken Authentication & Session Management) at Bouncy Castle Dependency in Crucible ServerCVE-2026-596428.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Crucible ServerCVE-2026-128028.7 High
DoS (Denial of Service) at org.bouncycastle:bcprov-jdk18on in Crucible ServerCVE-2026-135068.7 High
BASM (Broken Authentication & Session Management) at Bouncy Castle Dependency in Crucible ServerCVE-2026-596398.7 High
DoS (Denial of Service) at org.jsoup:jsoup Dependency in Crucible ServerCVE-2026-751408.7 High
DoS (Denial of Service) at org.apache.httpcomponents.core5:httpcore5-h2 Dependency in Crucible Data Center and ServerCVE-2026-544287.5 High
DoS (Denial of Service) at com.mchange:mchange-commons-java Dependency in Crucible ServerCVE-2026-551537.1 High
Jira Data Center and Server
  • 11.3.0 to 11.3.10 (LTS)
  • 11.2.0 to 11.2.1
  • 11.1.0 to 11.1.1
  • 11.0.0 to 11.0.1
  • 10.7.1 to 10.7.4
  • 10.6.0 to 10.6.1
  • 10.5.0 to 10.5.1
  • 10.4.0 to 10.4.1
  • 10.3.0 to 10.3.24 (LTS)
  • 10.2.0 to 10.2.1
  • 10.1.1 to 10.1.2
  • 9.17.3 to 9.17.5
  • 9.12.14 to 9.12.38 (LTS)
  • 11.3.11 (LTS) recommended Data Center Only
  • 10.3.25 (LTS) Data Center Only
BASM (Broken Authentication & Session Management) org.bouncycastle:bcprov-jdk18on Dependency in Jira Software Data CenterCVE-2026-8763

9.3 Critical

This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

Injection org.bouncycastle:bcprov-lts8on Dependency in Jira Software Data CenterCVE-2026-59650

9.3 Critical

This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Jira Software Data Center and ServerCVE-2026-53434

9.1 Critical

This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Jira Software Data Center and ServerCVE-2026-55276

9.1 Critical

This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

Injection json5 Dependency in Jira Software Data CenterCVE-2022-461758.8 High
DoS (Denial of Service) Apache Tomcat Dependency in Jira Software Data CenterCVE-2026-580598.7 High
DOM-based XSS tinymce Dependency in Jira Software Data CenterCVE-2026-477618.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Jira Software Data CenterCVE-2026-146828.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data CenterCVE-2026-128038.7 High
DoS (Denial of Service) immutable Dependency in Jira Software Data CenterCVE-2026-598808.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data CenterCVE-2026-128028.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data Center and ServerCVE-2026-128168.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data Center and ServerCVE-2026-596428.7 High
DoS (Denial of Service) immutable Dependency in Jira Software Data CenterCVE-2026-598798.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Jira Software Data CenterCVE-2026-580608.7 High
DoS (Denial of Service) Apache Tomcat Dependency in Jira Software Data Center and ServerCVE-2026-135068.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data CenterCVE-2026-596398.7 High
DOM-based XSS tinymce Dependency in Jira Software Data CenterCVE-2026-477598.7 High
DOM-based XSS tinymce Dependency in Jira Software Data CenterCVE-2026-477628.7 High
Information Disclosure axios Dependency in Jira Software Data CenterCVE-2026-673208.3 High
RCE (Remote Code Execution) @babel/plugin-transform-modules-systemjs Dependency in Jira Software Data CenterCVE-2026-447288.2 High
DoS (Denial of Service) nanoid Dependency in Jira Software Data Center and ServerCVE-2026-672148.2 High
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator in Jira Software Data CenterCVE-2026-545138.1 High
DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency in Jira Software Data CenterCVE-2026-545128.1 High
DoS (Denial of Service) io.netty:netty-codec Dependency in Jira Software Data CenterCVE-2026-735077.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data CenterCVE-2026-758997.5 High
DoS (Denial of Service) browserslist Dependency in Jira Software Data CenterCVE-2026-730887.5 High
DoS (Denial of Service) js-yaml Dependency in Jira Software Data CenterCVE-2026-598697.5 High
DoS (Denial of Service) browserslist Dependency in Jira Software Data CenterCVE-2026-730897.5 High
DoS (Denial of Service) brace-expansion Dependency in Jira Software Data CenterCVE-2026-142577.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data CenterCVE-2026-759757.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data CenterCVE-2026-761727.5 High
DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Jira Software Data CenterCVE-2026-687637.5 High
File Inclusion postcss Dependency in Jira Software Data CenterCVE-2026-736467.5 High
Injection fast-uri Dependency in Jira Software Data CenterCVE-2026-136767.5 High
Injection fast-uri Dependency in Jira Software Data CenterCVE-2026-162217.5 High
DoS (Denial of Service) brace-expansion Dependency in Jira Software Data CenterCVE-2026-691527.5 High
Injection fast-uri Dependency in Jira Software Data CenterCVE-2026-184467.5 High
DoS (Denial of Service) node-tar dependency tar Dependency in Jira Software Data CenterCVE-2026-735667.5 High
CSRF (Cross-Site Request Forgery) nanoid Dependency in Jira Software Data CenterCVE-2026-730867.4 High
Apache Tomcat: Bad ornext processing in RewriteValve in Jira Software Data CenterCVE-2026-534047.3 High
Jira Service Management Data Center and Server
  • 11.3.0 to 11.3.10 (LTS)
  • 11.2.0 to 11.2.1
  • 11.1.0 to 11.1.1
  • 11.0.0 to 11.0.1
  • 10.7.1 to 10.7.4
  • 10.6.0 to 10.6.1
  • 10.5.0 to 10.5.1
  • 10.4.0 to 10.4.1
  • 10.3.0 to 10.3.24 (LTS)
  • 10.2.0 to 10.2.1
  • 10.1.1 to 10.1.2
  • 5.17.3 to 5.17.5
  • 11.3.11 (LTS) recommended Data Center Only
  • 10.3.25 (LTS) Data Center Only
BASM (Broken Authentication & Session Management) in Jira Service Management Data CenterCVE-2026-8763

9.3 Critical

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

Injection at Bouncy Castle Dependency in Jira Service Management Data CenterCVE-2026-59650

9.3 Critical

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Jira Service Management Data Center and ServerCVE-2026-53434

9.1 Critical

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Jira Service Management Data Center and ServerCVE-2026-55276

9.1 Critical

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk.

Injection json5 Dependency in Jira Service Management Data CenterCVE-2022-461758.8 High
DoS (Denial of Service) immutable Dependency in Jira Service Management Data CenterCVE-2026-598798.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Service Management Data Center and ServerCVE-2026-128028.7 High
DoS (Denial of Service) immutable.js Dependency in Jira Service Management Data Center and ServerCVE-2026-598808.7 High
DoS (Denial of Service) Apache Tomcat Dependency in Jira Service Management Data Center and ServerCVE-2026-135068.7 High
DoS (Denial of Service) linkify-it Dependency in Jira Service Management Data CenterCVE-2026-488018.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Service Management Data Center and ServerCVE-2026-596398.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Service Management Data Center and ServerCVE-2026-596428.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-jdk18on Dependency in Jira Service Management Data CenterCVE-2026-580608.7 High
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Jira Service Management Data CenterCVE-2026-146828.7 High
DOM-based XSS tinymce Dependency in Jira Service Management Data CenterCVE-2026-477618.7 High
DOM-based XSS tinymce Dependency in Jira Service Management Data CenterCVE-2026-477628.7 High
DOM-based XSS tinymce Dependency in Jira Service Management Data CenterCVE-2026-477598.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Service Management Data Center and ServerCVE-2026-128038.7 High
DoS (Denial of Service) Apache Tomcat Dependency in Jira Service Management Data Center and ServerCVE-2026-580598.7 High
BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Service Management Data Center and ServerCVE-2026-128168.7 High
Information Disclosure axios Dependency in Jira Service Management Data CenterCVE-2026-673208.3 High
RCE (Remote Code Execution) @babel/plugin-transform-modules-systemjs Dependency in Jira Service Management Data CenterCVE-2026-447288.2 High
DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency in Jira Service Management Data CenterCVE-2026-545128.1 High
RCE (Remote Code Execution) jackson-databind Dependency in Jira Service Management Data Center and ServerCVE-2026-545138.1 High
DoS (Denial of Service) brace-expansion Dependency in Jira Service Management Data CenterCVE-2026-142577.5 High
DoS (Denial of Service) browserslist Dependency in Jira Service Management Data CenterCVE-2026-730887.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Service Management Data CenterCVE-2026-758997.5 High
Injection fast-uri Dependency in Jira Service Management Data CenterCVE-2026-136767.5 High
DoS (Denial of Service) js-yaml Dependency in Jira Service Management Data CenterCVE-2026-598697.5 High
DoS (Denial of Service) io.netty:netty-codec Dependency in Jira Service Management Data CenterCVE-2026-735077.5 High
File Inclusion postcss Dependency in Jira Service Management Data CenterCVE-2026-736467.5 High
DoS (Denial of Service) linkify-it Dependency in Jira Service Management Data CenterCVE-2026-598877.5 High
Injection fast-uri Dependency in Jira Service Management Data CenterCVE-2026-162217.5 High
DoS (Denial of Service) tar Dependency in Jira Service Management Data CenterCVE-2026-735667.5 High
DoS (Denial of Service) browserslist Dependency in Jira Service Management Data CenterCVE-2026-730897.5 High
DoS (Denial of Service) brace-expansion Dependency in Jira Service Management Data CenterCVE-2026-691527.5 High
Injection fast-uri Dependency in Jira Service Management Data CenterCVE-2026-184467.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Service Management Data CenterCVE-2026-759757.5 High
SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Service Management Data CenterCVE-2026-761727.5 High
DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Jira Service Management Data CenterCVE-2026-687637.5 High
BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Jira Service Management Data Center and ServerCVE-2026-534047.3 High


Frequently Asked Questions:

  • Why is my Feature Version not listed in a Fixed Version? You may be using an unsupported version and need to patch to the latest version or Long-Term Support (LTS) version.

  • What are the most up-to-date Data Center product versions? You can always check the software download portal or visit the product-specific download pages.

  • I am using an LTS, why is it not listed in the Fixed Versions? Your LTS version may not have been updated yet or a backported fix may not have been feasible. Please see our Security Bug Fix Policy for more information. We recommend upgrading your products to the latest versions. For the latest fixed versions, visit the release notes linked in the vulnerability table.

  • Questions about the bulletin, have feedback? Let us know! Read more about our bulletins and feel free to contribute feedback on our latest Community Post


To search for CVEs or check your products versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.

Last modified on Sep 15, 2026

Was this helpful?

Yes
No
Provide feedback about this article

Related content

  • No related content found
Powered by Confluence and Scroll Viewport.