Atlassian patches critical flaws in Confluence, Jira
French CERT-FR warns of multiple vulnerabilities in Atlassian Confluence and Jira products enabling remote code execution, denial of service, and data breaches.
The French national cybersecurity agency CERT-FR has issued an advisory covering dozens of vulnerabilities across Atlassian's Confluence Data Center and Jira product lines (Software, Service Management). The flaws span remote code execution, server-side request forgery (SSRF), cross-site scripting (XSS), security bypass, denial of service, and confidentiality violations. Affected versions include Confluence 9.2.x and 10.2.x branches, and Jira Software/Service Management 9.12.x, 10.3.x, and 11.3.x releases.
Atlassian released patches on 16 June 2026 addressing over 30 CVEs, many specific to these enterprise collaboration platforms. The advisory references numerous individual security bulletins indexed by internal tracking IDs (CONFSERVER-*, JSDSERVER-*, JSWSERVER-*). Organizations running on-premises Confluence or Jira deployments should prioritize patching to the latest minor releases: Confluence 9.2.21/10.2.13 and Jira 9.12.36/10.3.22/11.3.7 (depending on branch).
While the advisory does not indicate active exploitation, the severity of remote code execution vectors in widely deployed enterprise tooling makes prompt remediation essential. The presence of SSRF and XSS issues also raises the risk of credential theft and lateral movement in environments where these platforms serve as central hubs for development and IT service workflows.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Confluence or Jira Java Process
Detects a shell or scripting interpreter being spawned as a child of the Confluence/Jira Java (Tomcat) service process, consistent with exploitation of an RCE vulnerability in these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Confluence or Jira Java Process
id: 8a6566d7-a38a-5481-9523-be0d7147b212
status: experimental
description: Detects command interpreters or shells launched as child processes of
the Java process running Confluence or Jira, which may indicate exploitation of
a remote code execution vulnerability in these enterprise collaboration platforms.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- confluence
- atlassian-confluence
- jira
- atlassian-jira
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \bash.exe
- \sh.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts invoked by scheduled maintenance tasks running
under the Confluence/Jira service account
- Backup or health-check tooling that shells out from the Java service wrapper
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
Suspicious Child Process Spawned by Confluence or Jira Java Process - Linux
Detects a shell being spawned as a child of the Confluence/Jira Java process on Linux hosts, consistent with exploitation of an RCE vulnerability in these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Confluence or Jira Java Process - Linux
id: 37671105-0041-5c4c-a8f9-1eb32354f4ce
status: experimental
description: Detects shell interpreters launched as child processes of the Java process
running Confluence or Jira on Linux, which may indicate exploitation of a remote
code execution vulnerability in these enterprise collaboration platforms.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentCommandLine|contains:
- confluence
- atlassian-confluence
- jira
- atlassian-jira
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /python3
- /perl
condition: selection_parent and selection_child
falsepositives:
- Internal maintenance or backup scripts that shell out from the Confluence/Jira service
account
- Health-check or monitoring agents invoking curl/wget from the same user context
level: high
tags:
- attack.t1059.004
- attack.execution
author: Vorant
Web Shell File Write in Confluence or Jira Webapps Directory
Detects creation of script or JSP files within Confluence/Jira installation or webapps directories, which is a common post-exploitation artifact after RCE against these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Shell File Write in Confluence or Jira Webapps Directory
id: b93f901b-988c-598b-b836-3f106e388d82
status: experimental
description: Detects the creation of executable script files (jsp, jspx, war, php)
inside directories associated with Confluence or Jira installations, which may indicate
deployment of a web shell following exploitation of a remote code execution vulnerability.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- confluence
- atlassian-confluence
- jira
- atlassian-jira
TargetFilename|endswith:
- .jsp
- .jspx
- .war
- .php
filter:
TargetFilename|contains:
- \install\
- \upgrade\
condition: selection and not filter
falsepositives:
- Legitimate plugin or application deployment/upgrade activity performed by administrators
- Vendor-provided patch installers dropping new JSP files as part of a version upgrade
level: medium
tags:
- attack.t1505.003
- attack.persistence
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0773/
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free