Security Advisories & Bulletins
CVE-2019-13990 - XXE (XML External Entity Injection) Vulnerability In Jira Service Management Data Center and Jira Service Management Server
CVE-2022-1471 - SnakeYAML library RCE Vulnerability impacts Multiple Products
CVE-2023-22522 - RCE Vulnerability In Confluence Data Center and Confluence Server
CVE-2023-22523 - RCE Vulnerability in Assets Discovery
CVE-2023-22524 - RCE Vulnerability in Atlassian Companion App for MacOS
CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server
CVE-2023-22518 - Improper Authorization Vulnerability In Confluence Data Center and Server
CVE-2023-46604 - Apache ActiveMQ RCE Vulnerability impacts Bamboo Data Center and Server
Multiple Products Security Advisory - Git Buffer Overflow - CVE-2022-41903, CVE-2022-23521
Security Bulletin - July 18 2023
Security Bulletin - August 15 2023
Security Bulletin - September 19 2023
Security Bulletin - October 17 2023
Security Bulletin - November 21 2023
Security Bulletin - December 12 2023
Security Bulletin - January 16 2024
Security Bulletin - February 20 2024
Security Bulletin - March 19 2024
Security Bulletin - April 16 2024
Security Bulletin - May 21 2024
Security Bulletin - June 18 2024
Security Bulletin - July 16 2024
Security Bulletin - August 20 2024
Security Bulletin - September 17 2024
Security Bulletin - October 15 2024
Security Bulletin - November 19 2024
Security Bulletin - December 10 2024
Security Bulletin - January 21 2025
Security Bulletin - February 18 2025
Security Bulletin - March 18 2025
Security Bulletin - April 15 2025
Security Bulletin - May 20 2025
Security Bulletin - June 17 2025
Security Bulletin - July 15 2025
Security Bulletin - August 19 2025
Security Bulletin - September 16 2025
Security Bulletin - October 21 2025
Security Bulletin - November 18 2025
Security Bulletin - December 11 2025
Security Bulletin - January 20 2026
Security Bulletin - February 17 2026
Security Bulletin - March 17 2026
Security Bulletin - April 21 2026
Security Bulletin - May 19 2026
Security Bulletin - June 16 2026
Security Bulletin - July 21 2026
CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products
Security Bulletin - August 18 2026
Security Bulletin - September 15 2026
The Atlassian Community is here for you.
Instance Health is now available in Portfolio Insights (Beta).
Monitor the performance and security of your Jira and Confluence Data Center instances — including CVE exposure, security misconfigurations, and Apdex-based performance scores — all in one place.
📤 Can't connect your instance to Cloud? No problem — with Manual Upload , you can simply upload a support.zip file and get the full benefits of all Instance Health features, including Instance Optimization, Performance Insights, and Security Insights. No cloud connection required.
Get started →
Learn Manual Upload →
Security Bulletins are released on the third Tuesday of every month. To disclosures, see our Vulnerability Disclosure Portal . For information on Atlassian cloud security, see our Security page .
Security Advisories and Bulletins
CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products
Security Bulletin - September 15 2026
Security Bulletin - August 18 2026
Security Bulletin - July 21 2026
Security Bulletin - June 16 2026
Security Bulletin - May 19 2026
Security Bulletin - April 21 2026
Security Bulletin - March 17 2026
Security Bulletin - February 17 2026
Security Bulletin - January 20 2026
Security Bulletin - December 11 2025
Security Bulletin - November 18 2025
Security Bulletin - October 21 2025
Security Bulletin - September 16 2025
Security Bulletin - August 19 2025
Security Bulletin - July 15 2025
Security Bulletin - June 17 2025
Security Bulletin - May 20 2025
Security Bulletin - April 15 2025
Security Bulletin - March 18 2025
Security Bulletin - February 18 2025
Security Bulletin - January 21 2025
Security Bulletin - December 10 2024
Security Bulletin - November 19 2024
Security Bulletin - October 15 2024
Security Bulletin - September 17 2024
Security Bulletin - August 20 2024
Security Bulletin - July 16 2024
Security Advisories for Apps
Archived Security Advisories
Security Bulletin - June 18 2024
Security Bulletin - May 21 2024
Security Bulletin - April 16 2024
Security Bulletin - March 19 2024
Security Bulletin - February 20 2024
January 2024: Security Advisories Overview
Security Bulletin - January 16 2024
CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server
December 2023: Security Advisories Overview
Security Bulletin - December 12 2023
CVE-2023-22524 - RCE Vulnerability in Atlassian Companion App for MacOS
CVE-2023-22523 - RCE Vulnerability in Assets Discovery
CVE-2023-22522 - RCE Vulnerability In Confluence Data Center and Confluence Server
Security Bulletin - November 21 2023
November 2023: Security Advisories Overview
CVE-2023-46604 - Apache ActiveMQ RCE Vulnerability impacts Bamboo Data Center and Server
CVE-2023-22518 - Improper Authorization Vulnerability In Confluence Data Center and Server
Security Bulletin - October 17 2023
October 2023: Security Advisories Overview
CVE-2019-13990 - XXE (XML External Entity Injection) Vulnerability In Jira Service Management Data Center and Jira Service Management Server
CVE-2022-1471 - SnakeYAML library RCE Vulnerability impacts Multiple Products
Security Bulletin - September 19 2023
Security Bulletin - August 15 2023
Security Bulletin - July 18 2023
January 2023: Security Advisories Overview
Multiple Products Security Advisory - Git Buffer Overflow - CVE-2022-41903, CVE-2022-23521
November 2022: Atlassian Security Advisories Overview
August 2022: Atlassian Security Advisories Overview
July 2022: Atlassian Security Advisories Overview
What are Security Bulletins?
Security Bulletins provide you with detailed information vulnerabilities mitigated in new versions, allowing you to make more informed decisions updating our products outside of Critical Security Advisories requiring immediate action.
What types of vulnerabilities are included in the Security Bulletin?
Security Bulletin disclosures include unique critical and high-severity vulnerabilities as well as dependency vulnerabilities, for our server and DC products.
Is there a Security Bulletin for Cloud customers?
No, the Security Bulletin is for server and DC products only. We are able to seamlessly patch Cloud vulnerabilities without any action required on the part of the customer. For information on Atlassian cloud security, see our Security page .
What do customers need to do when a Security Bulletin is released?
Upgrading to new versions in a timely manner is an important step in keeping your Atlassian server and DC products secure, and we encourage customers to keep versions current. Though we will continue to issue Critical Security Advisories for vulnerabilities requiring immediate action, our goal with the Security Bulletin is to issue non-critical updates that can be supported on a regular maintenance schedule.
Is this change due to an increase in the number of vulnerabilities in Atlassian products?
No, the Security Bulletin and Portal are an enhancement to our ability to disclose fixed vulnerabilities, and do not reflect any changes in our processes to identify and fix them. The types of fixed vulnerabilities you will see in the new disclosures were previously fixed in released product versions. With this new monthly cadence, we’re able to offer greater transparency into the list of vulnerabilities mitigated under each new version (not just the most pressing) and encourage customers to support security best practices with a regular maintenance schedule. Atlassian will continue to issue Critical Security Advisories for vulnerabilities requiring immediate action.
November 2022: Atlassian Security Advisories Overview
Archived Security Advisories
Security Advisories for Apps
July 2022: Atlassian Security Advisories Overview
August 2022: Atlassian Security Advisories Overview
January 2023: Security Advisories Overview
October 2023: Security Advisories Overview
November 2023: Security Advisories Overview
December 2023: Security Advisories Overview
January 2024: Security Advisories Overview
CVE-2019-13990 - XXE (XML External Entity Injection) Vulnerability In Jira Service Management Data Center and Jira Service Management Server
CVE-2022-1471 - SnakeYAML library RCE Vulnerability impacts Multiple Products
CVE-2023-22522 - RCE Vulnerability In Confluence Data Center and Confluence Server
CVE-2023-22523 - RCE Vulnerability in Assets Discovery
CVE-2023-22524 - RCE Vulnerability in Atlassian Companion App for MacOS
CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server
CVE-2023-22518 - Improper Authorization Vulnerability In Confluence Data Center and Server
CVE-2023-46604 - Apache ActiveMQ RCE Vulnerability impacts Bamboo Data Center and Server
Multiple Products Security Advisory - Git Buffer Overflow - CVE-2022-41903, CVE-2022-23521
Security Bulletin - July 18 2023
Security Bulletin - August 15 2023
Security Bulletin - September 19 2023
Security Bulletin - October 17 2023
Security Bulletin - November 21 2023
Security Bulletin - December 12 2023
Security Bulletin - January 16 2024
Security Bulletin - February 20 2024
Security Bulletin - March 19 2024
Security Bulletin - April 16 2024
Security Bulletin - May 21 2024
Security Bulletin - June 18 2024
Security Bulletin - July 16 2024
Security Bulletin - August 20 2024
Security Bulletin - September 17 2024
Security Bulletin - October 15 2024
Security Bulletin - November 19 2024
Security Bulletin - December 10 2024
Security Bulletin - January 21 2025
Security Bulletin - February 18 2025
Security Bulletin - March 18 2025
Security Bulletin - April 15 2025
Security Bulletin - May 20 2025
Security Bulletin - June 17 2025
Security Bulletin - July 15 2025
Security Bulletin - August 19 2025
Security Bulletin - September 16 2025
Security Bulletin - October 21 2025
Security Bulletin - November 18 2025
Security Bulletin - December 11 2025
Security Bulletin - January 20 2026
Security Bulletin - February 17 2026
Security Bulletin - March 17 2026
Security Bulletin - April 21 2026
Security Bulletin - May 19 2026
Security Bulletin - June 16 2026
Security Bulletin - July 21 2026
CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products
Security Bulletin - August 18 2026
Security Bulletin - September 15 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
