# Atlassian patches critical flaws in Confluence, Jira

Published: 2026-06-18 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/1367969e-0c94-5b66-b40c-011dcf1826d7/atlassian-patches-critical-flaws-in-confluence-jira

> French CERT-FR warns of multiple vulnerabilities in Atlassian Confluence and Jira products enabling remote code execution, denial of service, and data breaches.

The French national cybersecurity agency CERT-FR has issued an advisory covering dozens of vulnerabilities across Atlassian's Confluence Data Center and Jira product lines (Software, Service Management). The flaws span remote code execution, server-side request forgery (SSRF), cross-site scripting (XSS), security bypass, denial of service, and confidentiality violations. Affected versions include Confluence 9.2.x and 10.2.x branches, and Jira Software/Service Management 9.12.x, 10.3.x, and 11.3.x releases.

Atlassian released patches on 16 June 2026 addressing over 30 CVEs, many specific to these enterprise collaboration platforms. The advisory references numerous individual security bulletins indexed by internal tracking IDs (CONFSERVER-*, JSDSERVER-*, JSWSERVER-*). Organizations running on-premises Confluence or Jira deployments should prioritize patching to the latest minor releases: Confluence 9.2.21/10.2.13 and Jira 9.12.36/10.3.22/11.3.7 (depending on branch).

While the advisory does not indicate active exploitation, the severity of remote code execution vectors in widely deployed enterprise tooling makes prompt remediation essential. The presence of SSRF and XSS issues also raises the risk of credential theft and lateral movement in environments where these platforms serve as central hubs for development and IT service workflows.

## Mentioned in this report

- Vulnerabilities: CVE-2021-3803, CVE-2026-26996, CVE-2026-27903, CVE-2026-27904, CVE-2026-29129, CVE-2026-33870, CVE-2026-33871, CVE-2026-34077, CVE-2026-34486 (templated), CVE-2026-34487, CVE-2026-40175, CVE-2026-41284, CVE-2026-41293, CVE-2026-42033, CVE-2026-42035, CVE-2026-42038, CVE-2026-42043, CVE-2026-42211, CVE-2026-42264, CVE-2026-42342, CVE-2026-42498, CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515, CVE-2026-44495, CVE-2026-45149, CVE-2026-45736

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Confluence or Jira Java Process

ATT&CK: T1059

Detects a shell or scripting interpreter being spawned as a child of the Confluence/Jira Java (Tomcat) service process, consistent with exploitation of an RCE vulnerability in these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Confluence or Jira Java Process
id: 8a6566d7-a38a-5481-9523-be0d7147b212
status: experimental
description: Detects command interpreters or shells launched as child processes of
  the Java process running Confluence or Jira, which may indicate exploitation of
  a remote code execution vulnerability in these enterprise collaboration platforms.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains:
    - confluence
    - atlassian-confluence
    - jira
    - atlassian-jira
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \bash.exe
    - \sh.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts invoked by scheduled maintenance tasks running
  under the Confluence/Jira service account
- Backup or health-check tooling that shells out from the Java service wrapper
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
```

### Suspicious Child Process Spawned by Confluence or Jira Java Process - Linux

ATT&CK: T1059.004

Detects a shell being spawned as a child of the Confluence/Jira Java process on Linux hosts, consistent with exploitation of an RCE vulnerability in these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Confluence or Jira Java Process - Linux
id: 37671105-0041-5c4c-a8f9-1eb32354f4ce
status: experimental
description: Detects shell interpreters launched as child processes of the Java process
  running Confluence or Jira on Linux, which may indicate exploitation of a remote
  code execution vulnerability in these enterprise collaboration platforms.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains:
    - confluence
    - atlassian-confluence
    - jira
    - atlassian-jira
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
    - /python3
    - /perl
  condition: selection_parent and selection_child
falsepositives:
- Internal maintenance or backup scripts that shell out from the Confluence/Jira service
  account
- Health-check or monitoring agents invoking curl/wget from the same user context
level: high
tags:
- attack.t1059.004
- attack.execution
author: Vorant
```

### Web Shell File Write in Confluence or Jira Webapps Directory

ATT&CK: T1505.003

Detects creation of script or JSP files within Confluence/Jira installation or webapps directories, which is a common post-exploitation artifact after RCE against these platforms. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Shell File Write in Confluence or Jira Webapps Directory
id: b93f901b-988c-598b-b836-3f106e388d82
status: experimental
description: Detects the creation of executable script files (jsp, jspx, war, php)
  inside directories associated with Confluence or Jira installations, which may indicate
  deployment of a web shell following exploitation of a remote code execution vulnerability.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - confluence
    - atlassian-confluence
    - jira
    - atlassian-jira
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .war
    - .php
  filter:
    TargetFilename|contains:
    - \install\
    - \upgrade\
  condition: selection and not filter
falsepositives:
- Legitimate plugin or application deployment/upgrade activity performed by administrators
- Vendor-provided patch installers dropping new JSP files as part of a version upgrade
level: medium
tags:
- attack.t1505.003
- attack.persistence
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0773/

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1367969e-0c94-5b66-b40c-011dcf1826d7/atlassian-patches-critical-flaws-in-confluence-jira.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup