Atlassian patches critical flaws in Confluence, Jira
French CERT-FR warns of multiple vulnerabilities in Atlassian Confluence and Jira products enabling remote code execution, denial of service, and data breaches.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 32 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-34486 as exploited in the wild.
The French national cybersecurity agency CERT-FR has issued an advisory covering dozens of vulnerabilities across Atlassian's Confluence Data Center and Jira product lines (Software, Service Management). The flaws span remote code execution, server-side request forgery (SSRF), cross-site scripting (XSS), security bypass, denial of service, and confidentiality violations. Affected versions include Confluence 9.2.x and 10.2.x branches, and Jira Software/Service Management 9.12.x, 10.3.x, and 11.3.x releases.
Atlassian released patches on 16 June 2026 addressing over 30 CVEs, many specific to these enterprise collaboration platforms. The advisory references numerous individual security bulletins indexed by internal tracking IDs (CONFSERVER-*, JSDSERVER-*, JSWSERVER-*). Organizations running on-premises Confluence or Jira deployments should prioritize patching to the latest minor releases: Confluence 9.2.21/10.2.13 and Jira 9.12.36/10.3.22/11.3.7 (depending on branch).
While the advisory does not indicate active exploitation, the severity of remote code execution vectors in widely deployed enterprise tooling makes prompt remediation essential. The presence of SSRF and XSS issues also raises the risk of credential theft and lateral movement in environments where these platforms serve as central hubs for development and IT service workflows.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Confluence or Jira Java Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter being spawned as a child of the Confluence/Jira Java (Tomcat) service process, consistent with exploitation of an RCE vulnerability in these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Confluence or Jira Java Process
id: 8a6566d7-a38a-5481-9523-be0d7147b212
status: experimental
description: Detects command interpreters or shells launched as child processes of
the Java process running Confluence or Jira, which may indicate exploitation of
a remote code execution vulnerability in these enterprise collaboration platforms.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- confluence
- atlassian-confluence
- jira
- atlassian-jira
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \bash.exe
- \sh.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts invoked by scheduled maintenance tasks running
under the Confluence/Jira service account
- Backup or health-check tooling that shells out from the Java service wrapper
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
Suspicious Child Process Spawned by Confluence or Jira Java Process - Linux
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell being spawned as a child of the Confluence/Jira Java process on Linux hosts, consistent with exploitation of an RCE vulnerability in these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Confluence or Jira Java Process - Linux
id: 37671105-0041-5c4c-a8f9-1eb32354f4ce
status: experimental
description: Detects shell interpreters launched as child processes of the Java process
running Confluence or Jira on Linux, which may indicate exploitation of a remote
code execution vulnerability in these enterprise collaboration platforms.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentCommandLine|contains:
- confluence
- atlassian-confluence
- jira
- atlassian-jira
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /python3
- /perl
condition: selection_parent and selection_child
falsepositives:
- Internal maintenance or backup scripts that shell out from the Confluence/Jira service
account
- Health-check or monitoring agents invoking curl/wget from the same user context
level: high
tags:
- attack.t1059.004
- attack.execution
author: Vorant
Web Shell File Write in Confluence or Jira Webapps Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of script or JSP files within Confluence/Jira installation or webapps directories, which is a common post-exploitation artifact after RCE against these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Shell File Write in Confluence or Jira Webapps Directory
id: b93f901b-988c-598b-b836-3f106e388d82
status: experimental
description: Detects the creation of executable script files (jsp, jspx, war, php)
inside directories associated with Confluence or Jira installations, which may indicate
deployment of a web shell following exploitation of a remote code execution vulnerability.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- confluence
- atlassian-confluence
- jira
- atlassian-jira
TargetFilename|endswith:
- .jsp
- .jspx
- .war
- .php
filter:
TargetFilename|contains:
- \install\
- \upgrade\
condition: selection and not filter
falsepositives:
- Legitimate plugin or application deployment/upgrade activity performed by administrators
- Vendor-provided patch installers dropping new JSP files as part of a version upgrade
level: medium
tags:
- attack.t1505.003
- attack.persistence
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0773/
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs