Vulnerability-Lookup

CVE-2026-34486 (GCVE-0-2026-34486)

Vulnerability from cvelistv5 – Published: 2026-04-09 19:35 – Updated: 2026-08-10 12:05

CISA KEVIntel

Title

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Summary

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: active Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 17:42 UTC

CWE

CWE-311 - Missing Encryption of Sensitive Data
CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Assigner

apache mitre root

References

21 references

URL	Tags
https://lists.apache.org/thread/9510k5p5zdvt9pkkg…	vendor-advisory
https://socradar.io/blog/snowlight-government-chi…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://www.vicarius.io/vsociety/posts/cve-2026-3…
https://www.vicarius.io/vsociety/posts/cve-2026-3…
https://access.redhat.com/security/cve/CVE-2026-34486	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2457027	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:39188	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38505	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36787	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36789	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36788	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36790	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37137	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37136	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36878	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36876	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36877	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36879	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39189	vendor-advisoryx_refsource_REDHAT

Impacted products

22 products

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache Tomcat	Affected: 11.0.20 (semver) Affected: 10.1.53 (semver) Affected: 9.0.116 (semver)	guessed
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:10.1.49-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:9.0.117-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:10.1.36-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:9.0.87-6.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:7.0.76-18.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 1:9.0.87-2.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 1:9.0.87-2.el8_8 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 1:9.0.87-2.el8_8 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:9.0.117-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 1:9.0.87-2.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 1:9.0.87-2.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 1:9.0.87-4.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat JBoss Web Server 7.0.0	cpe:/a:redhat:jboss_enterprise_web_server:7.0
Red Hat	Red Hat JBoss Web Server 7.0 on RHEL 10	Unaffected: 0:11.0.21-5.redhat_00004.1.el10jws , < * (rpm) cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10
Red Hat	Red Hat JBoss Web Server 7.0 on RHEL 8	Unaffected: 0:11.0.21-5.redhat_00004.1.el8jws , < * (rpm) cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8
Red Hat	Red Hat JBoss Web Server 7.0 on RHEL 9	Unaffected: 0:11.0.21-5.redhat_00004.1.el9jws , < * (rpm) cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat JBoss Web Server 5	cpe:/a:redhat:jboss_enterprise_web_server:5
Red Hat	Red Hat JBoss Web Server 6	cpe:/a:redhat:jboss_enterprise_web_server:6

Credits

Bartlomiej Dmitruk at striga.ai

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: ac2344a6-31bc-4723-9ed3-ced1cafad44a

Vulnerability ID: CVE-2026-34486

Status: Confirmed

Status Updated: 2026-08-04 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-08-04

Asserted: 2026-08-04

Scope

Notes: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | Affected: Apache / Tomcat | Description: Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-08-07 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34486

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-311
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Tomcat
Due Date	2026-08-07
Date Added	2026-08-04
Vendorproject	Apache
Vulnerabilityname	Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-34486

Created: 2026-08-04 18:00 UTC | Updated: 2026-08-04 18:00 UTC

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 4e9a3540-8de8-40a3-980a-a0e3aeded844

Vulnerability ID: CVE-2026-34486

Status: Confirmed

Status Updated: 2026-08-04 16:45 UTC

Exploited: Yes

Timestamps

First Seen: 2026-08-04

Asserted: 2026-08-04

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Vendor	Apache Software Foundation
Product	Apache Tomcat
Added Date	2026-08-04T16:45:52.078Z
Cvss Score	7.5
Epss Score	0.42627
Cvss Severity	HIGH
Epss Percentile	0.9858
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-08-04 18:00 UTC | Updated: 2026-08-04 18:00 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34486",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:42:15.722474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-34486",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T17:59:33.086782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-08-04",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T17:59:36.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://socradar.io/blog/snowlight-government-chinese-campaign/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-26T18:16:14.258Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:10.1.49-3.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat9",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.117-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:10.1.36-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat9",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.87-6.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.0.76-18.el7_9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.87-2.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.87-2.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.87-2.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.117-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.87-2.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.87-2.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "tomcat",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:9.0.87-4.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_web_server:7.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "tomcat",
            "product": "Red Hat JBoss Web Server 7.0.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "jws7-tomcat",
            "product": "Red Hat JBoss Web Server 7.0 on RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:11.0.21-5.redhat_00004.1.el10jws",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jws7-tomcat",
            "product": "Red Hat JBoss Web Server 7.0 on RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:11.0.21-5.redhat_00004.1.el8jws",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "jws7-tomcat",
            "product": "Red Hat JBoss Web Server 7.0 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:11.0.21-5.redhat_00004.1.el9jws",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "tomcat6",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "pki-deps:10.6/pki-servlet-engine",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "pki-servlet-engine",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_web_server:5"
            ],
            "defaultStatus": "unaffected",
            "packageName": "tomcat",
            "product": "Red Hat JBoss Web Server 5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_web_server:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "tomcat",
            "product": "Red Hat JBoss Web Server 6",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-09T19:35:35.994Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Apache Tomcat. This vulnerability, categorized as Missing Encryption of Sensitive Data, arises from a bypass in the EncryptInterceptor, a component designed to ensure data encryption. This bypass, introduced as a fix for CVE-2026-29146, allows sensitive data to remain unencrypted, potentially leading to information disclosure."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-807",
                "description": "Reliance on Untrusted Inputs in a Security Decision",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T12:05:44.488Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-34486"
          },
          {
            "name": "RHBZ#2457027",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457027"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39188"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38505"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36787"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36788"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36790"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37137"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37136"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36878"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36876"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36877"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36879"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39189"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:39188: Red Hat JBoss Web Server 7.0 on RHEL 10, Red Hat JBoss Web Server 7.0 on RHEL 8, Red Hat JBoss Web Server 7.0 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38505: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36787: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36789: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36788: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36790: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37137: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37136: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36878: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36876: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36877: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36879: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39189: Red Hat JBoss Web Server 7.0.0"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-09T20:01:26.022Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-09T19:35:35.994Z",
            "value": "Made public."
          }
        ],
        "title": "Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "11.0.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "10.1.53",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.0.116",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bartlomiej Dmitruk at striga.ai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the\u0026nbsp;fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the\u00a0fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "CWE-311 Missing Encryption of Sensitive Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T19:35:35.994Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-34486",
    "datePublished": "2026-04-09T19:35:35.994Z",
    "dateReserved": "2026-03-30T07:57:49.315Z",
    "dateUpdated": "2026-08-10T12:05:44.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-34486",
      "cwes": "[\"CWE-311\"]",
      "dateAdded": "2026-08-04",
      "dueDate": "2026-08-07",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34486",
      "product": "Tomcat",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "shortDescription": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE\u20112025\u201124813.",
      "vendorProject": "Apache",
      "vulnerabilityName": "Apache Tomcat Missing Encryption of Sensitive Data Vulnerability"
    },
    "epss": {
      "cve": "CVE-2026-34486",
      "date": "2026-08-21",
      "epss": "0.82933",
      "percentile": "0.99648"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34486\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-04-09T20:16:25.063\",\"lastModified\":\"2026-08-10T13:19:04.337\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the\u00a0fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\\n\\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\\n\\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Tomcat\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"11.0.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.1.53\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"9.0.116\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"1:10.1.49-3.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat9\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"1:9.0.117-2.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"1:10.1.36-2.el10_0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat9\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"1:9.0.87-6.el10_0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7 Extended Lifecycle Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/o:redhat:rhel_els:7\"],\"versions\":[{\"version\":\"0:7.0.76-18.el7_9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"1:9.0.87-2.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8\"],\"versions\":[{\"version\":\"1:9.0.87-2.el8_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8\"],\"versions\":[{\"version\":\"1:9.0.87-2.el8_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"1:9.0.117-2.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2\"],\"versions\":[{\"version\":\"1:9.0.87-2.el9_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.4\"],\"versions\":[{\"version\":\"1:9.0.87-2.el9_4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6\"],\"versions\":[{\"version\":\"1:9.0.87-4.el9_6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 7.0.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:7.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 7.0 on RHEL 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jws7-tomcat\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10\"],\"versions\":[{\"version\":\"0:11.0.21-5.redhat_00004.1.el10jws\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 7.0 on RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jws7-tomcat\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8\"],\"versions\":[{\"version\":\"0:11.0.21-5.redhat_00004.1.el8jws\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 7.0 on RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jws7-tomcat\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9\"],\"versions\":[{\"version\":\"0:11.0.21-5.redhat_00004.1.el9jws\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat6\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pki-deps:10.6/pki-servlet-engine\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pki-servlet-engine\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tomcat\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:6\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-04T17:42:15.722474Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-06T17:59:33.086782Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-04T17:42:15.722474Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-06T17:59:33.086782Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-04T17:42:15.722474Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-06T17:59:33.086782Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-04T17:42:15.722474Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-06T17:59:33.086782Z\",\"id\":\"CVE-2026-34486\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2026-08-04\",\"cisaActionDue\":\"2026-08-07\",\"cisaRequiredAction\":\"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\",\"cisaVulnerabilityName\":\"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability\",\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-311\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-807\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC160F23-A9D6-42DA-92E6-886B1B1F48A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E7A0CE9-EBDF-4305-9C06-E7D4521AF422\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"64BAAE4D-2355-43D8-83E5-01CA71D5DC0B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:jboss_web_server:7.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F764C52A-4533-4C39-A5A2-A5E1FE20960C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_els:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0460F769-D90A-4446-AC00-24F66BDBF526\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34990D09-125F-48CA-B85E-9D9F0EB4BC07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22D28543-C7C5-46B0-B909-20435AF7A501\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01ED4F33-EBE7-4C04-8312-3DA580EFFB68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FD9BF0E-7ACF-4A83-B754-6E3979ED903F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18B7F648-9A31-4EE5-A215-C860616A4AB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"554AA8CA-A930-4788-B052-497E09D48381\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36787\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36788\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36789\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36790\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36876\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36877\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36878\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36879\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37136\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37137\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:38505\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:39188\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:39189\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-34486\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2457027\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://socradar.io/blog/snowlight-government-chinese-campaign/\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-07T19:13:47+00:00",
      "cve": "CVE-2026-34486",
      "id": "CVE-2026-34486",
      "initial_release_date": "2026-04-09T19:35:35.994000+00:00",
      "product_status:fixed": "150",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T00:40:21Z",
      "cve": "CVE-2026-34486",
      "id": "CVE-2026-34486",
      "initial_release_date": "2026-04-10T23:25:29Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "1",
      "product_status:recommended": "439",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-34486",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-34486.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat\"}, {\"url\": \"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat\"}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-05-26T18:16:14.258Z\"}}, {\"title\": \"Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:10.1.49-3.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.117-2.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:10.1.36-2.el10_0\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.87-6.el10_0\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_els:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7 Extended Lifecycle Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:7.0.76-18.el7_9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.87-2.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.87-2.el8_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.87-2.el8_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.117-2.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.87-2.el9_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.87-2.el9_4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:9.0.87-4.el9_6\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:7.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 7.0.0\", \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 7.0 on RHEL 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:11.0.21-5.redhat_00004.1.el10jws\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"jws7-tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 7.0 on RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:11.0.21-5.redhat_00004.1.el8jws\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"jws7-tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 7.0 on RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:11.0.21-5.redhat_00004.1.el9jws\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"jws7-tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"tomcat6\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"pki-deps:10.6/pki-servlet-engine\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"pki-servlet-engine\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:5\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 5\", \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 6\", \"packageName\": \"tomcat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-09T20:01:26.022Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-09T19:35:35.994Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:39188: Red Hat JBoss Web Server 7.0 on RHEL 10, Red Hat JBoss Web Server 7.0 on RHEL 8, Red Hat JBoss Web Server 7.0 on RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:38505: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36787: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36789: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36788: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36790: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37137: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37136: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36878: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36876: Red Hat Enterprise Linux AppStream E4S (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36877: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36879: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:39189: Red Hat JBoss Web Server 7.0.0\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-09T19:35:35.994Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-34486\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2457027\", \"name\": \"RHBZ#2457027\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:39188\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:38505\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36787\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36789\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36788\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36790\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37137\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37136\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36878\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36876\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36877\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36879\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:39189\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Apache Tomcat. This vulnerability, categorized as Missing Encryption of Sensitive Data, arises from a bypass in the EncryptInterceptor, a component designed to ensure data encryption. This bypass, introduced as a fix for CVE-2026-29146, allows sensitive data to remain unencrypted, potentially leading to information disclosure.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-807\", \"description\": \"Reliance on Untrusted Inputs in a Security Decision\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-10T12:05:44.488Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34486\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-06T17:59:33.086782Z\"}}}, {\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34486\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-06T17:59:33.086782Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2026-08-04\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486\"}}}], \"references\": [{\"url\": \"https://socradar.io/blog/snowlight-government-chinese-campaign/\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-10T20:20:27.094Z\"}}], \"cna\": {\"title\": \"Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Bartlomiej Dmitruk at striga.ai\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Tomcat\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.0.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.1.53\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"9.0.116\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the\\u00a0fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\\n\\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\\n\\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMissing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the\u0026nbsp;fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-311\", \"description\": \"CWE-311 Missing Encryption of Sensitive Data\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-04-09T19:35:35.994Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34486\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T12:05:44.488Z\", \"dateReserved\": \"2026-03-30T07:57:49.315Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-04-09T19:35:35.994Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

WID-SEC-W-2026-1038

Vulnerability from csaf_certbund - Published: 2026-04-09 22:00 - Updated: 2026-07-21 22:00

Summary

Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Open-Redirect-Angriffe durchzuführen und andere, nicht näher spezifizierte Angriffe auszuführen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-24880

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-25854

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-29129

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-29145

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-29146

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-32990

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-34483

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-34486

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-34487

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

CVE-2026-34500

Affected products

Known affected 21 products

Product	Identifier	Version
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
IBM Power Hardware Management Console IBM	`cpe:/a:ibm:hardware_management_console:-`	—
Apache Tomcat <11.0.19 Apache / Tomcat		<11.0.19
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Apache Tomcat Native <1.3.7 Apache / Tomcat		Native <1.3.7
Apache Tomcat Native <2.0.14 Apache / Tomcat		Native <2.0.14
Red Hat JBoss Web Server <6.2.3 Red Hat / JBoss Web Server		<6.2.3
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Apache Tomcat <9.0.116 Apache / Tomcat		<9.0.116
Apache Tomcat <9.0.117 Apache / Tomcat		<9.0.117
Apache Tomcat <10.1.53 Apache / Tomcat		<10.1.53
Apache Tomcat <11.0.20 Apache / Tomcat		<11.0.20
Apache Tomcat <11.0.21 Apache / Tomcat		<11.0.21
IBM Spectrum Protect Plus IBM	`cpe:/a:ibm:spectrum_protect_plus:-`	—
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
Apache Tomcat <10.1.52 Apache / Tomcat		<10.1.52
Apache Tomcat <10.1.54 Apache / Tomcat		<10.1.54
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—

References

48 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://tomcat.apache.org/security-9.html	external
https://tomcat.apache.org/security-10.html	external
https://tomcat.apache.org/security-11.html	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2026…	external
https://access.redhat.com/errata/RHSA-2026:12195	external
https://access.redhat.com/errata/RHSA-2026:12194	external
https://support.hcl-software.com/community?id=com…	external
https://access.redhat.com/errata/RHSA-2026:20405	external
https://access.redhat.com/errata/RHSA-2026:20406	external
https://github.com/striga-ai/CVE-2026-34486	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://security-tracker.debian.org/tracker/DSA-6328-1	external
https://security-tracker.debian.org/tracker/DSA-6329-1	external
https://www.ibm.com/support/pages/node/7278011	external
https://linux.oracle.com/errata/ELSA-2026-26323.html	external
https://linux.oracle.com/errata/ELSA-2026-18916.html	external
https://www.ibm.com/support/pages/node/7278738	external
https://access.redhat.com/errata/RHSA-2026:36789	external
https://access.redhat.com/errata/RHSA-2026:36790	external
https://access.redhat.com/errata/RHSA-2026:36877	external
https://access.redhat.com/errata/RHSA-2026:36879	external
https://access.redhat.com/errata/RHSA-2026:36876	external
https://access.redhat.com/errata/RHSA-2026:36878	external
https://access.redhat.com/errata/RHSA-2026:37136	external
https://linux.oracle.com/errata/ELSA-2026-36879.html	external
https://errata.build.resf.org/RLSA-2026:37137	external
https://linux.oracle.com/errata/ELSA-2026-37137.html	external
https://errata.build.resf.org/RLSA-2026:36788	external
https://errata.build.resf.org/RLSA-2026:36790	external
https://errata.build.resf.org/RLSA-2026:36879	external
https://access.redhat.com/errata/RHSA-2026:38505	external
https://access.redhat.com/errata/RHSA-2026:39189	external
https://linux.oracle.com/errata/ELSA-2026-18536.html	external
https://linux.oracle.com/errata/ELSA-2026-36788.html	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache Tomcat ist ein Web-Applikationsserver f\u00fcr verschiedene Plattformen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Open-Redirect-Angriffe durchzuf\u00fchren und andere, nicht n\u00e4her spezifizierte Angriffe auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1038 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1038.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1038 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1038"
      },
      {
        "category": "external",
        "summary": "Apache Tomcat 9 vulnerabilities vom 2026-04-09",
        "url": "https://tomcat.apache.org/security-9.html"
      },
      {
        "category": "external",
        "summary": "Apache Tomcat 10 vulnerabilities vom 2026-04-09",
        "url": "https://tomcat.apache.org/security-10.html"
      },
      {
        "category": "external",
        "summary": "Apache Tomcat 11 vulnerabilities vom 2026-04-09",
        "url": "https://tomcat.apache.org/security-11.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:10548-1 vom 2026-04-15",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QNEDM6RBHQEARIDUITXLNEYREGQXXWW5/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:10549-1 vom 2026-04-15",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MEFQXVLFFJSJMLHOKAARZ4TAVX5QBSU5/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:10547-1 vom 2026-04-15",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2ENRWN4ZNTHX5V7VJZHUZGDSHXMJHD2Y/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1558-1 vom 2026-04-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025569.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:20612-1 vom 2026-04-23",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6JYOECIHMTZAXAOESLTCB5WLXF2FKMPT/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:20611-1 vom 2026-04-23",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M5H5Q3AIANVMCJDNLDOJKP7ZEVFCMTAL/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1572-1 vom 2026-04-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025601.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1603-1 vom 2026-04-24",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025617.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1604-1 vom 2026-04-24",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025616.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:21378-1 vom 2026-04-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025729.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:21379-1 vom 2026-04-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025728.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:21366-1 vom 2026-04-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025739.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2TOMCAT9-2026-025 vom 2026-04-30",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2026-025.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:12195 vom 2026-04-30",
        "url": "https://access.redhat.com/errata/RHSA-2026:12195"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:12194 vom 2026-04-30",
        "url": "https://access.redhat.com/errata/RHSA-2026:12194"
      },
      {
        "category": "external",
        "summary": "HCL Security Bulletin vom 2026-05-12",
        "url": "https://support.hcl-software.com/community?id=community_blog\u0026sys_id=2f600efd2bf4c7900c64f1a1d891bf19"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:20405 vom 2026-05-26",
        "url": "https://access.redhat.com/errata/RHSA-2026:20405"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:20406 vom 2026-05-26",
        "url": "https://access.redhat.com/errata/RHSA-2026:20406"
      },
      {
        "category": "external",
        "summary": "PoC CVE-2026-34486 vom 2026-05-28",
        "url": "https://github.com/striga-ai/CVE-2026-34486"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4619 vom 2026-06-07",
        "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00008.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6328 vom 2026-06-08",
        "url": "https://security-tracker.debian.org/tracker/DSA-6328-1"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6329 vom 2026-06-08",
        "url": "https://security-tracker.debian.org/tracker/DSA-6329-1"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7278011 vom 2026-06-25",
        "url": "https://www.ibm.com/support/pages/node/7278011"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-26323 vom 2026-06-25",
        "url": "https://linux.oracle.com/errata/ELSA-2026-26323.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-18916 vom 2026-06-29",
        "url": "https://linux.oracle.com/errata/ELSA-2026-18916.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7278738 vom 2026-07-01",
        "url": "https://www.ibm.com/support/pages/node/7278738"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36789 vom 2026-07-08",
        "url": "https://access.redhat.com/errata/RHSA-2026:36789"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36790 vom 2026-07-08",
        "url": "https://access.redhat.com/errata/RHSA-2026:36790"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36877 vom 2026-07-09",
        "url": "https://access.redhat.com/errata/RHSA-2026:36877"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36879 vom 2026-07-09",
        "url": "https://access.redhat.com/errata/RHSA-2026:36879"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36876 vom 2026-07-09",
        "url": "https://access.redhat.com/errata/RHSA-2026:36876"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36878 vom 2026-07-09",
        "url": "https://access.redhat.com/errata/RHSA-2026:36878"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:37136 vom 2026-07-09",
        "url": "https://access.redhat.com/errata/RHSA-2026:37136"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-36879 vom 2026-07-09",
        "url": "https://linux.oracle.com/errata/ELSA-2026-36879.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:37137 vom 2026-07-10",
        "url": "https://errata.build.resf.org/RLSA-2026:37137"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-37137 vom 2026-07-09",
        "url": "https://linux.oracle.com/errata/ELSA-2026-37137.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:36788 vom 2026-07-10",
        "url": "https://errata.build.resf.org/RLSA-2026:36788"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:36790 vom 2026-07-10",
        "url": "https://errata.build.resf.org/RLSA-2026:36790"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:36879 vom 2026-07-10",
        "url": "https://errata.build.resf.org/RLSA-2026:36879"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:38505 vom 2026-07-13",
        "url": "https://access.redhat.com/errata/RHSA-2026:38505"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:39189 vom 2026-07-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:39189"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-18536 vom 2026-07-22",
        "url": "https://linux.oracle.com/errata/ELSA-2026-18536.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-36788 vom 2026-07-21",
        "url": "https://linux.oracle.com/errata/ELSA-2026-36788.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache Tomcat und Tomcat Native: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-21T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-22T09:20:15.652+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1038",
      "initial_release_date": "2026-04-09T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-09T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-04-15T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von openSUSE aufgenommen"
        },
        {
          "date": "2026-04-22T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-04-23T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-04-26T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-04-28T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-04-29T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2026-05-03T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-12T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-05-26T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-28T22:00:00.000+00:00",
          "number": "11",
          "summary": "PoC f\u00fcr CVE-2026-34486 aufgenommen"
        },
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2026-06-08T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2026-06-25T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von IBM und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-06-29T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2026-07-01T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-07-08T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-09T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-07-12T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen"
        },
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        }
      ],
      "status": "final",
      "version": "21"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c11.0.20",
                "product": {
                  "name": "Apache Tomcat \u003c11.0.20",
                  "product_id": "T052614"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.20",
                "product": {
                  "name": "Apache Tomcat 11.0.20",
                  "product_id": "T052614-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:11.0.20"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.1.52",
                "product": {
                  "name": "Apache Tomcat \u003c10.1.52",
                  "product_id": "T052615"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.52",
                "product": {
                  "name": "Apache Tomcat 10.1.52",
                  "product_id": "T052615-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:10.1.52"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.0.116",
                "product": {
                  "name": "Apache Tomcat \u003c9.0.116",
                  "product_id": "T052616"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.116",
                "product": {
                  "name": "Apache Tomcat 9.0.116",
                  "product_id": "T052616-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:9.0.116"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.1.53",
                "product": {
                  "name": "Apache Tomcat \u003c10.1.53",
                  "product_id": "T052617"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.53",
                "product": {
                  "name": "Apache Tomcat 10.1.53",
                  "product_id": "T052617-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:10.1.53"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Native \u003c1.3.7",
                "product": {
                  "name": "Apache Tomcat Native \u003c1.3.7",
                  "product_id": "T052618"
                }
              },
              {
                "category": "product_version",
                "name": "Native 1.3.7",
                "product": {
                  "name": "Apache Tomcat Native 1.3.7",
                  "product_id": "T052618-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:native__1.3.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Native \u003c2.0.14",
                "product": {
                  "name": "Apache Tomcat Native \u003c2.0.14",
                  "product_id": "T052619"
                }
              },
              {
                "category": "product_version",
                "name": "Native 2.0.14",
                "product": {
                  "name": "Apache Tomcat Native 2.0.14",
                  "product_id": "T052619-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:native__2.0.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.0.19",
                "product": {
                  "name": "Apache Tomcat \u003c11.0.19",
                  "product_id": "T052624"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.19",
                "product": {
                  "name": "Apache Tomcat 11.0.19",
                  "product_id": "T052624-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:11.0.19"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.0.21",
                "product": {
                  "name": "Apache Tomcat \u003c11.0.21",
                  "product_id": "T052625"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.21",
                "product": {
                  "name": "Apache Tomcat 11.0.21",
                  "product_id": "T052625-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:11.0.21"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.1.54",
                "product": {
                  "name": "Apache Tomcat \u003c10.1.54",
                  "product_id": "T052626"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.54",
                "product": {
                  "name": "Apache Tomcat 10.1.54",
                  "product_id": "T052626-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:10.1.54"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.0.117",
                "product": {
                  "name": "Apache Tomcat \u003c9.0.117",
                  "product_id": "T052627"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.117",
                "product": {
                  "name": "Apache Tomcat 9.0.117",
                  "product_id": "T052627-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:9.0.117"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Tomcat"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.1.0-9.1.19.0",
                "product": {
                  "name": "HCL Commerce 9.1.0-9.1.19.0",
                  "product_id": "T053858",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Commerce"
          }
        ],
        "category": "vendor",
        "name": "HCL"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Power Hardware Management Console",
            "product": {
              "name": "IBM Power Hardware Management Console",
              "product_id": "5114",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:hardware_management_console:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM Spectrum Protect Plus",
            "product": {
              "name": "IBM Spectrum Protect Plus",
              "product_id": "T044769",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:spectrum_protect_plus:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T054581",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.2.3",
                "product": {
                  "name": "Red Hat JBoss Web Server \u003c6.2.3",
                  "product_id": "T054708"
                }
              },
              {
                "category": "product_version",
                "name": "6.2.3",
                "product": {
                  "name": "Red Hat JBoss Web Server 6.2.3",
                  "product_id": "T054708-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.2.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-24880",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-24880"
    },
    {
      "cve": "CVE-2026-25854",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-25854"
    },
    {
      "cve": "CVE-2026-29129",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-29129"
    },
    {
      "cve": "CVE-2026-29145",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-29145"
    },
    {
      "cve": "CVE-2026-29146",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-29146"
    },
    {
      "cve": "CVE-2026-32990",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-32990"
    },
    {
      "cve": "CVE-2026-34483",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-34483"
    },
    {
      "cve": "CVE-2026-34486",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-34486"
    },
    {
      "cve": "CVE-2026-34487",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-34487"
    },
    {
      "cve": "CVE-2026-34500",
      "product_status": {
        "known_affected": [
          "T054581",
          "67646",
          "5114",
          "T052624",
          "T004914",
          "T052618",
          "T052619",
          "T054708",
          "2951",
          "T002207",
          "T052616",
          "T052627",
          "T052617",
          "T052614",
          "T052625",
          "T044769",
          "T053858",
          "T052615",
          "T052626",
          "T027843",
          "398363"
        ]
      },
      "release_date": "2026-04-09T22:00:00.000+00:00",
      "title": "CVE-2026-34500"
    }
  ]
}

WID-SEC-W-2026-1955

Vulnerability from csaf_certbund - Published: 2026-06-16 22:00 - Updated: 2026-08-02 22:00

Summary

Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen

Severity

Hoch

Notes

Produktbeschreibung: Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet. Bitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle. Confluence ist eine kommerzielle Wiki-Software. Fisheye ist ein Quellcode-Repository-Browser für Unternehmensteams. Crucible ist eine Code-Review-Lösung für Unternehmensteams. Jira ist eine Webanwendung zur Softwareentwicklung.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2019-11272

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2021-3803

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2022-1471

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2022-22965

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2022-22978

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2022-31692

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2024-22257

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2025-22228

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-22732

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-24734

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-26996

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-27903

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-27904

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-29129

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-33870

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-33871

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-34077

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-34486

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-34487

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-40175

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-41044

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-41284

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-41293

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42033

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42035

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42038

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42043

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42198

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42211

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42264

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42342

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42498

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42579

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42581

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42583

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42584

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42585

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-42587

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-43512

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-43513

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-43515

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-44486

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-44487

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-44488

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-44492

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-44495

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-44496

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-45149

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

CVE-2026-45736

Affected products

Known affected 15 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Atlassian Crucible <4.9.11 Atlassian / Crucible		<4.9.11
Atlassian Fisheye <4.9.11 Atlassian / Fisheye		<4.9.11
Atlassian Confluence Data Center <9.2.21 Atlassian / Confluence		Data Center <9.2.21
Atlassian Confluence Data Center <10.2.13 Atlassian / Confluence		Data Center <10.2.13
Atlassian Bitbucket Data Center <10.3.1 Atlassian / Bitbucket		Data Center <10.3.1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Atlassian Bitbucket Data Center <9.4.21 Atlassian / Bitbucket		Data Center <9.4.21
Atlassian Bitbucket Data Center <10.2.4 Atlassian / Bitbucket		Data Center <10.2.4
Atlassian Jira Service Management Data Center and Server <10.3.22 Atlassian / Jira		Service Management Data Center and Server <10.3.22
Atlassian Jira Service Management Data Center and Server <11.3.7 Atlassian / Jira		Service Management Data Center and Server <11.3.7
Atlassian Bamboo Data Center <12.1.8 Atlassian / Bamboo		Data Center <12.1.8
Atlassian Jira Data Center <10.3.22 Atlassian / Jira		Data Center <10.3.22
Atlassian Jira Data Center <11.3.7 Atlassian / Jira		Data Center <11.3.7
Atlassian Bamboo Data Center <10.2.20 Atlassian / Bamboo		Data Center <10.2.20

References

42 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://confluence.atlassian.com/security/securit…	external
https://access.redhat.com/errata/RHSA-2026:22380	external
https://access.redhat.com/errata/RHSA-2026:27171	external
https://access.redhat.com/errata/RHSA-2026:7634	external
https://access.redhat.com/errata/RHSA-2026:29197	external
https://access.redhat.com/errata/RHSA-2026:30076	external
https://access.redhat.com/errata/RHSA-2026:30651	external
https://access.redhat.com/errata/RHSA-2026:30650	external
https://access.redhat.com/errata/RHSA-2026:33155	external
https://access.redhat.com/errata/RHSA-2026:33160	external
https://access.redhat.com/errata/RHSA-2026:33183	external
https://access.redhat.com/errata/RHSA-2026:33173	external
https://access.redhat.com/errata/RHSA-2026:33163	external
https://access.redhat.com/errata/RHSA-2026:33005	external
https://access.redhat.com/errata/RHSA-2026:34374	external
https://access.redhat.com/errata/RHSA-2026:28964	external
https://access.redhat.com/errata/RHSA-2026:36820	external
https://access.redhat.com/errata/RHSA-2026:36883	external
https://access.redhat.com/errata/RHSA-2026:40138	external
https://access.redhat.com/errata/RHSA-2026:40119	external
https://access.redhat.com/errata/RHSA-2026:40262	external
https://access.redhat.com/errata/RHSA-2026:41928	external
https://access.redhat.com/errata/RHSA-2026:42146	external
https://access.redhat.com/errata/RHSA-2026:42142	external
https://access.redhat.com/errata/RHSA-2026:42085	external
https://access.redhat.com/errata/RHSA-2026:42078	external
https://access.redhat.com/errata/RHSA-2026:40768	external
https://access.redhat.com/errata/RHSA-2026:42796	external
https://access.redhat.com/errata/RHSA-2026:40792	external
https://access.redhat.com/errata/RHSA-2026:40795	external
https://access.redhat.com/errata/RHSA-2026:43052	external
https://access.redhat.com/errata/RHSA-2026:46885	external
https://access.redhat.com/errata/RHSA-2026:46903	external
https://access.redhat.com/errata/RHSA-2026:44263	external
https://access.redhat.com/errata/RHSA-2026:44267	external
https://access.redhat.com/errata/RHSA-2026:47388	external
https://access.redhat.com/errata/RHSA-2026:47451	external
https://access.redhat.com/errata/RHSA-2026:48124	external
https://access.redhat.com/errata/RHSA-2026:48151	external
http://linux.oracle.com/errata/ELSA-2026-47058.html	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.\r\nBitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.\r\nConfluence ist eine kommerzielle Wiki-Software.\r\nFisheye ist ein Quellcode-Repository-Browser f\u00fcr Unternehmensteams. \r\nCrucible ist eine Code-Review-L\u00f6sung f\u00fcr Unternehmensteams.\r\nJira ist eine Webanwendung zur Softwareentwicklung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuf\u00fchren, erweiterte Berechtigungen zu erlangen, Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszul\u00f6sen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1955 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1955.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1955 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1955"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin Juni vom 2026-06-16",
        "url": "https://confluence.atlassian.com/security/security-bulletin-june-16-2026-1796309326.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:22380 vom 2026-06-18",
        "url": "https://access.redhat.com/errata/RHSA-2026:22380"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:27171 vom 2026-06-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:27171"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:7634 vom 2026-06-18",
        "url": "https://access.redhat.com/errata/RHSA-2026:7634"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:29197 vom 2026-06-24",
        "url": "https://access.redhat.com/errata/RHSA-2026:29197"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:30076 vom 2026-06-25",
        "url": "https://access.redhat.com/errata/RHSA-2026:30076"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:30651 vom 2026-06-28",
        "url": "https://access.redhat.com/errata/RHSA-2026:30651"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:30650 vom 2026-06-28",
        "url": "https://access.redhat.com/errata/RHSA-2026:30650"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:33155 vom 2026-06-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:33155"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:33160 vom 2026-06-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:33160"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:33183 vom 2026-06-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:33183"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:33173 vom 2026-06-30",
        "url": "https://access.redhat.com/errata/RHSA-2026:33173"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:33163 vom 2026-06-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:33163"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:33005 vom 2026-06-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:33005"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:34374 vom 2026-07-01",
        "url": "https://access.redhat.com/errata/RHSA-2026:34374"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:28964 vom 2026-07-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:28964"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36820 vom 2026-07-08",
        "url": "https://access.redhat.com/errata/RHSA-2026:36820"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36883 vom 2026-07-09",
        "url": "https://access.redhat.com/errata/RHSA-2026:36883"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:40138 vom 2026-07-15",
        "url": "https://access.redhat.com/errata/RHSA-2026:40138"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:40119 vom 2026-07-15",
        "url": "https://access.redhat.com/errata/RHSA-2026:40119"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:40262 vom 2026-07-16",
        "url": "https://access.redhat.com/errata/RHSA-2026:40262"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:41928 vom 2026-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:41928"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42146 vom 2026-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:42146"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42142 vom 2026-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:42142"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42085 vom 2026-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:42085"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42078 vom 2026-07-21",
        "url": "https://access.redhat.com/errata/RHSA-2026:42078"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:40768 vom 2026-07-21",
        "url": "https://access.redhat.com/errata/RHSA-2026:40768"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:42796 vom 2026-07-21",
        "url": "https://access.redhat.com/errata/RHSA-2026:42796"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:40792 vom 2026-07-21",
        "url": "https://access.redhat.com/errata/RHSA-2026:40792"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:40795 vom 2026-07-21",
        "url": "https://access.redhat.com/errata/RHSA-2026:40795"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:43052 vom 2026-07-22",
        "url": "https://access.redhat.com/errata/RHSA-2026:43052"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:46885 vom 2026-07-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:46885"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:46903 vom 2026-07-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:46903"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:44263 vom 2026-07-28",
        "url": "https://access.redhat.com/errata/RHSA-2026:44263"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:44267 vom 2026-07-28",
        "url": "https://access.redhat.com/errata/RHSA-2026:44267"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:47388 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:47388"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:47451 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:47451"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:48124 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:48124"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:48151 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:48151"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-08-01",
        "url": "http://linux.oracle.com/errata/ELSA-2026-47058.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-02T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-03T07:17:55.294+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1955",
      "initial_release_date": "2026-06-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-17T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-18T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-24T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-25T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-28T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-29T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-01T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-08T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-15T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-19T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-27T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-28T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-29T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-08-02T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        }
      ],
      "status": "final",
      "version": "17"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c12.1.8",
                "product": {
                  "name": "Atlassian Bamboo Data Center \u003c12.1.8",
                  "product_id": "T055489"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 12.1.8",
                "product": {
                  "name": "Atlassian Bamboo Data Center 12.1.8",
                  "product_id": "T055489-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center__12.1.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.2.20",
                "product": {
                  "name": "Atlassian Bamboo Data Center \u003c10.2.20",
                  "product_id": "T055490"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.2.20",
                "product": {
                  "name": "Atlassian Bamboo Data Center 10.2.20",
                  "product_id": "T055490-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center__10.2.20"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.2.4",
                "product": {
                  "name": "Atlassian Bitbucket Data Center \u003c10.2.4",
                  "product_id": "T055492"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.2.4",
                "product": {
                  "name": "Atlassian Bitbucket Data Center 10.2.4",
                  "product_id": "T055492-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center__10.2.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c9.4.21",
                "product": {
                  "name": "Atlassian Bitbucket Data Center \u003c9.4.21",
                  "product_id": "T055493"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 9.4.21",
                "product": {
                  "name": "Atlassian Bitbucket Data Center 9.4.21",
                  "product_id": "T055493-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center__9.4.21"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.3.1",
                "product": {
                  "name": "Atlassian Bitbucket Data Center \u003c10.3.1",
                  "product_id": "T055494"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.3.1",
                "product": {
                  "name": "Atlassian Bitbucket Data Center 10.3.1",
                  "product_id": "T055494-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center__10.3.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bitbucket"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.2.13",
                "product": {
                  "name": "Atlassian Confluence Data Center \u003c10.2.13",
                  "product_id": "T055495"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.2.13",
                "product": {
                  "name": "Atlassian Confluence Data Center 10.2.13",
                  "product_id": "T055495-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center__10.2.13"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c9.2.21",
                "product": {
                  "name": "Atlassian Confluence Data Center \u003c9.2.21",
                  "product_id": "T055496"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 9.2.21",
                "product": {
                  "name": "Atlassian Confluence Data Center 9.2.21",
                  "product_id": "T055496-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center__9.2.21"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Confluence"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.9.11",
                "product": {
                  "name": "Atlassian Crucible \u003c4.9.11",
                  "product_id": "T055498"
                }
              },
              {
                "category": "product_version",
                "name": "4.9.11",
                "product": {
                  "name": "Atlassian Crucible 4.9.11",
                  "product_id": "T055498-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:crucible:4.9.11"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Crucible"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.9.11",
                "product": {
                  "name": "Atlassian Fisheye \u003c4.9.11",
                  "product_id": "T055497"
                }
              },
              {
                "category": "product_version",
                "name": "4.9.11",
                "product": {
                  "name": "Atlassian Fisheye 4.9.11",
                  "product_id": "T055497-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:fisheye:4.9.11"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Fisheye"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c11.3.7",
                "product": {
                  "name": "Atlassian Jira Data Center \u003c11.3.7",
                  "product_id": "T055499"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 11.3.7",
                "product": {
                  "name": "Atlassian Jira Data Center 11.3.7",
                  "product_id": "T055499-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:data_center__11.3.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.3.22",
                "product": {
                  "name": "Atlassian Jira Data Center \u003c10.3.22",
                  "product_id": "T055500"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.3.22",
                "product": {
                  "name": "Atlassian Jira Data Center 10.3.22",
                  "product_id": "T055500-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:data_center__10.3.22"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Service Management Data Center and Server \u003c11.3.7",
                "product": {
                  "name": "Atlassian Jira Service Management Data Center and Server \u003c11.3.7",
                  "product_id": "T055501"
                }
              },
              {
                "category": "product_version",
                "name": "Service Management Data Center and Server 11.3.7",
                "product": {
                  "name": "Atlassian Jira Service Management Data Center and Server 11.3.7",
                  "product_id": "T055501-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:service_management_data_center_and_server__11.3.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Service Management Data Center and Server \u003c10.3.22",
                "product": {
                  "name": "Atlassian Jira Service Management Data Center and Server \u003c10.3.22",
                  "product_id": "T055502"
                }
              },
              {
                "category": "product_version",
                "name": "Service Management Data Center and Server 10.3.22",
                "product": {
                  "name": "Atlassian Jira Service Management Data Center and Server 10.3.22",
                  "product_id": "T055502-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:service_management_data_center_and_server__10.3.22"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Jira"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T056236",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-11272",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2019-11272"
    },
    {
      "cve": "CVE-2021-3803",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2021-3803"
    },
    {
      "cve": "CVE-2022-1471",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2022-1471"
    },
    {
      "cve": "CVE-2022-22965",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2022-22965"
    },
    {
      "cve": "CVE-2022-22978",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2022-22978"
    },
    {
      "cve": "CVE-2022-31692",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2022-31692"
    },
    {
      "cve": "CVE-2024-22257",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2024-22257"
    },
    {
      "cve": "CVE-2025-22228",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2025-22228"
    },
    {
      "cve": "CVE-2026-22732",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-22732"
    },
    {
      "cve": "CVE-2026-24734",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-24734"
    },
    {
      "cve": "CVE-2026-26996",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-26996"
    },
    {
      "cve": "CVE-2026-27903",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-27903"
    },
    {
      "cve": "CVE-2026-27904",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-27904"
    },
    {
      "cve": "CVE-2026-29129",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-29129"
    },
    {
      "cve": "CVE-2026-33870",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-33870"
    },
    {
      "cve": "CVE-2026-33871",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-33871"
    },
    {
      "cve": "CVE-2026-34077",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-34077"
    },
    {
      "cve": "CVE-2026-34486",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-34486"
    },
    {
      "cve": "CVE-2026-34487",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-34487"
    },
    {
      "cve": "CVE-2026-40175",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-40175"
    },
    {
      "cve": "CVE-2026-41044",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-41044"
    },
    {
      "cve": "CVE-2026-41284",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-41284"
    },
    {
      "cve": "CVE-2026-41293",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-41293"
    },
    {
      "cve": "CVE-2026-42033",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42033"
    },
    {
      "cve": "CVE-2026-42035",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42035"
    },
    {
      "cve": "CVE-2026-42038",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42038"
    },
    {
      "cve": "CVE-2026-42043",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42043"
    },
    {
      "cve": "CVE-2026-42198",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42198"
    },
    {
      "cve": "CVE-2026-42211",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42211"
    },
    {
      "cve": "CVE-2026-42264",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42264"
    },
    {
      "cve": "CVE-2026-42342",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42342"
    },
    {
      "cve": "CVE-2026-42498",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42498"
    },
    {
      "cve": "CVE-2026-42579",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42579"
    },
    {
      "cve": "CVE-2026-42581",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42581"
    },
    {
      "cve": "CVE-2026-42583",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42583"
    },
    {
      "cve": "CVE-2026-42584",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42584"
    },
    {
      "cve": "CVE-2026-42585",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42585"
    },
    {
      "cve": "CVE-2026-42587",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-42587"
    },
    {
      "cve": "CVE-2026-43512",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-43512"
    },
    {
      "cve": "CVE-2026-43513",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-43513"
    },
    {
      "cve": "CVE-2026-43515",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-43515"
    },
    {
      "cve": "CVE-2026-44486",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-44486"
    },
    {
      "cve": "CVE-2026-44487",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-44487"
    },
    {
      "cve": "CVE-2026-44488",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-44488"
    },
    {
      "cve": "CVE-2026-44492",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-44492"
    },
    {
      "cve": "CVE-2026-44495",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-44495"
    },
    {
      "cve": "CVE-2026-44496",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-44496"
    },
    {
      "cve": "CVE-2026-45149",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-45149"
    },
    {
      "cve": "CVE-2026-45736",
      "product_status": {
        "known_affected": [
          "T056236",
          "T055498",
          "T055497",
          "T055496",
          "T055495",
          "T055494",
          "67646",
          "T055493",
          "T055492",
          "T055502",
          "T055501",
          "T055489",
          "T055500",
          "T055499",
          "T055490"
        ]
      },
      "release_date": "2026-06-16T22:00:00.000+00:00",
      "title": "CVE-2026-45736"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-34486 (GCVE-0-2026-34486)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

WID-SEC-W-2026-1038

WID-SEC-W-2026-1955

Tags

Sightings

Nomenclature