Securityaffairs Critical Vulnerabilities Discovered in Atlassian Products
Article Content
- •Two critical vulnerabilities in Atlassian products identified: CVE-2026-21589 and CVE-2026-102255.
- •CVE-2026-21589 has a CVSS score of 9.3; CVE-2026-102255 scores a perfect 10.0.
- •Exploitation attempts against these vulnerabilities have started, emphasizing the need for immediate patching.
Two critical vulnerabilities have been reported in Atlassian products, CVE-2026-21589 and CVE-2026-102255. CVE-2026-21589, with a CVSS score of 9.3, was published on October 5, 2026, and its first public proof-of-concept (PoC) was released on October 7, 2026. CVE-2026-102255, published on October 7, 2026, has a CVSS score of 10.0 and is considered critical. Exploitation attempts against these vulnerabilities have reportedly begun. Organizations using affected Atlassian products are urged to apply patches immediately to mitigate risks. The vulnerabilities potentially expose sensitive data and systems to attackers. The situation is evolving, and further updates are expected as more information becomes available.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track PoeLLM, OpenAI and CVE-2026-102255 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVSS scores for the vulnerabilities?
Have these vulnerabilities been exploited in the wild?
What should organizations do to protect themselves?
Continue Reading
PoeLLM Malware Compromises 3,400+ AI Servers via GitHub Poem The PoeLLM malware campaign, tracked by Lumen Technologies' Black Lotus Labs, has infected over 3,400 servers since April 2026, primarily targeting exposed AI services like LiteLLM and Ollama. The malware cleverly hides its command-and-control (C2) server addresses within a poem posted on GitHub, allowing attackers to… 
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…