[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 2 sources · 17 days · First seen · Last updated

Atlassian and Oracle software security vulnerabilities

Overview

In early October 2026, Atlassian disclosed a critical arbitrary file access vulnerability (CVE-2026-21589) affecting eight Data Center products, including Confluence, Bitbucket, and Jira Software. The flaw, carrying a CVSS score of 9.3, allowed unauthenticated attackers to read specific files within a web application’s root directory. Exploitation attempts were detected shortly after the technical details were made public, with activity originating from the United States and Japan.

Later in the month, Atlassian released a broader security bulletin covering 75 unique CVEs, many of which were tied to third-party dependencies. While these included 14 critical-severity vulnerabilities, Atlassian assessed the overall risk to customers as non-critical and reported no active exploitation. During the same period, Oracle issued an advisory addressing 1,295 vulnerabilities, including six flaws with a maximum CVSS rating of 10.0 affecting products such as Oracle E-Business Suite and Oracle Access Manager.

Entities

Atlassian · Bitbucket · Jira Software · Apache Tomcat · Confluence

Timeline

  1. [TECHNOLOGY] 2 sources
    Oracle and Atlassian release major security patches

    Oracle and Atlassian have released significant security updates to address numerous vulnerabilities, including several critical flaws in Oracle's flagship suites and Atlassian's software products.

  2. [TECHNOLOGY] 11 sources
    Atlassian discloses critical file access flaw in Data Center products

    Atlassian has issued an emergency advisory for a critical (CVSS 9.3) file access vulnerability affecting eight Data Center products, including Jira and Confluence. Exploitation attempts have already been noted.

Sources

csoonline.com.au · cybernoz.com