Atlassian April 2026 Security Bulletin: 31 High/Critical CVEs including RCE in Confluence

Atlassian Security Bulletin Summary – April 21, 2026 Vulnerability Overview This security bulletin includes 31 high-severity vulnerabilities and 7 critical vulnerabilities, affecting multiple Atlassian products via their dependent components. All vulnerabilities were discovered through third-party library scanning, bug bounty programs, and penetration testing. Impact Scope and Remediation 🚨 Critical Vulnerabilities 1. Confluence Data Center and Server CVE-2026-1471: RCE (Remote Code Execution) - Dependency: - Affected Versions: 10.2.0 to 10.2.7 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) - Risk Note: Not an Atlassian dependency, but Atlassian applications have a lower non-critical assessed risk 2. Jira Data Center and Server CVE-2026-47875: XSS (Cross-Site Scripting) - Dependency: - Affected Versions: 11.3.0 to 11.3.3 (LTS) - Fixed Version: 11.3.4 (LTS) (Data Center only) - Risk Note: Not an Atlassian dependency, but Atlassian applications have a lower non-critical assessed risk CVE-2022-1471: RCE (Remote Code Execution) - Dependency: - Affected Versions: 10.4.0 to 10.4.1 - Fixed Version: 10.3.19 (LTS) (Data Center only) - Risk Note: Not an Atlassian dependency, but Atlassian applications have a lower non-critical assessed risk CVE-2026-25547: DoS (Denial of Service) - Dependency: - Affected Versions: 10.0.0 to 10.0.1 - Fixed Version: 10.3.19 (LTS) (Data Center only) - Risk Note: Not an Atlassian dependency, but Atlassian applications have a lower non-critical assessed risk 3. Jira Service Management Data Center and Server CVE-2026-47875: XSS (Cross-Site Scripting) - Dependency: - Affected Versions: 11.3.0 to 11.3.3 (LTS) - Fixed Version: 11.3.4 (LTS) (Data Center only) - Risk Note: Not an Atlassian dependency, but Atlassian applications have a lower non-critical assessed risk CVE-2022-1471: RCE (Remote Code Execution) - Dependency: - Affected Versions: 10.6.0 to 10.6.1 - Fixed Version: 10.3.19 (LTS) (Data Center only) - Risk Note: Not an Atlassian dependency, but Atlassian applications have a lower non-critical assessed risk CVE-2021-31597: MITM (Man-in-the-Middle Attack) - Dependency: - Affected Versions: 10.2.0 to 10.2.1 - Fixed Version: 10.3.19 (LTS) (Data Center only) - Risk Note: Not an Atlassian dependency, but Atlassian applications have a lower non-critical assessed risk --- ⚠️ High Severity Vulnerabilities Bamboo Data Center and Server CVE-2026-33871: DoS (Denial of Service) - Dependency: - Affected Versions: 12.1.0 to 12.1.3 (LTS) - Fixed Version: 12.1.6 (LTS) CVE-2026-34487: Information Disclosure - Dependency: - Affected Versions: 12.0.0 to 12.0.2 - Fixed Version: 10.2.18 (LTS) (Data Center only) CVE-2026-33870: HTTP Request Smuggling - Dependency: - Affected Versions: 11.0.0 to 11.0.8 - Fixed Version: 10.2.18 (LTS) (Data Center only) Bitbucket Data Center and Server CVE-2022-25927: DoS (Denial of Service) - Dependency: - Affected Versions: 10.1.1 to 10.1.5 - Fixed Version: 10.2.0 to 10.2.2 (LTS) (Data Center only) Confluence Data Center and Server CVE-2026-24734: MITM (Man-in-the-Middle Attack) - Dependency: - Affected Versions: 10.0.0 to 10.0.3 - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-25639: DoS (Denial of Service) - Dependency: - Affected Versions: 10.1.0 to 10.1.2 - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-45801: XSS (Cross-Site Scripting) - Dependency: - Affected Versions: 9.3.1 to 9.3.4 - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-23950: Path Traversal (Arbitrary Write) - Dependency: - Affected Versions: 9.3.1 to 9.3.2 - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-33871: DoS (Denial of Service) - Dependency: - Affected Versions: 9.2.0 to 9.2.17 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-29063: Immutable Injection - Dependency: - Affected Versions: 9.0.1 to 9.0.3 - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-23745: File Inclusion ( ) - Dependency: - Affected Versions: 8.9.1 to 8.9.8 - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-24842: File Inclusion ( ) - Dependency: - Affected Versions: 9.1.0 to 9.1.0 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-31802: DOM-based XSS ( ) - Dependency: - Affected Versions: 9.1.0 to 9.1.0 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-66020: DoS (Denial of Service) - Dependency: - Affected Versions: 9.1.0 to 9.1.0 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-29371: DoS (Denial of Service) - Dependency: - Affected Versions: 9.1.0 to 9.1.0 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-33870: HTTP Request Smuggling - Dependency: - Affected Versions: 9.1.0 to 9.1.0 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2026-25639: DoS (Denial of Service) - Dependency: - Affected Versions: 9.1.0 to 9.1.0 (LTS) - Fixed Version: 10.2.10 (LTS) (Data Center only) CVE-2023-46031: DoS (Denial of Service) - Dependency: - Affected Versions: 9.1.0 to 9.1.0 (LTS) - Fixed Ve

Goal Reached Thanks to every supporter — we hit 100%!

Atlassian April 2026 Security Bulletin: 31 High/Critical CVEs including RCE in Confluence