Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 befor

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• atlassian bamboobefore 3.3.4
• atlassian bamboo3.4 and later · before 3.4.5
• atlassian confluencebefore 3.5.16
• atlassian confluence server4.0 and later · before 4.0.7
• atlassian confluence server4.1 and later · before 4.1.10
• atlassian crowdbefore 2.0.9
• atlassian crowd2.1 and later · before 2.1.2
• atlassian crowd2.2.0 and later · before 2.2.9
• atlassian crowd2.3.0 and later · before 2.3.7
• atlassian crowd2.4.0 and later · before 2.4.1
• atlassian cruciblebefore 2.5.8
• atlassian crucible2.6 and later · before 2.6.8
• atlassian crucible2.7 and later · before 2.7.12
• atlassian fisheyebefore 2.5.8
• atlassian fisheye2.6 and later · before 2.6.8
• atlassian fisheye2.7 and later · before 2.7.12
• atlassian jirabefore 5.0.1

Other highest-scoring records for the same primary product.

• CVE-2022-26136A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p
  41Plan
• CVE-2016-5229Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote a
  41Plan
• CVE-2015-8360An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via
  40Plan
• CVE-2014-9757The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers
  40Plan
• CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.
  39Monitor
• CVE-2026-21571This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0,
  37Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.