Vulnerabilities by vendor · updated on every deploy
Atlassian vulnerabilities: exploited CVEs and our analysis
Atlassian has 14 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 1 of them added in the last 12 months and 8 known to be used in ransomware campaigns. Below: the analysis Zero Hunt Research published on Atlassian products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
14
CVEs in CISA KEV
1
Added in the last 12 months
8
Known ransomware use
1
Zero Hunt analyses
Products with the most KEV entries: Confluence Data Center and Server (3) · Confluence Server and Data Center (2) · Jira Server and Data Center (2) · Bitbucket Server and Data Center (1) · Confluence (1) · Confluence Server (1)
Our analysis of Atlassian vulnerabilities
2026-10-06
Atlassian CVE-2026-21589: unauthenticated file read across 8 Data Center productsAtlassian's CVE-2026-21589 lets unauthenticated attackers read known files on Jira, Confluence, Bitbucket and five more Data Center products. Patch now.
All 14 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-10-15 | CVE-2026-21589 | Multiple Products Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files… | 2026-10-18 | Forensic triage | Read → |
| 2024-11-12 | CVE-2021-26086 | Jira Server and Data Center Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint. | 2024-12-03 | — | |
| 2024-01-24 | CVE-2023-22527 | Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. | 2024-02-14 | Ransomware | — |
| 2023-11-07 | CVE-2023-22518 | Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality… | 2023-11-28 | Ransomware | — |
| 2023-10-05 | CVE-2023-22515 | Confluence Data Center and Server Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence. | 2023-10-13 | Ransomware | — |
| 2022-09-30 | CVE-2022-36804 | Bitbucket Server and Data Center Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one,… | 2022-10-21 | — | |
| 2022-07-29 | CVE-2022-26138 | Confluence Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all con… | 2022-08-19 | — | |
| 2022-06-02 | CVE-2022-26134 | Confluence Server/Data Center Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution. | 2022-06-06 | Ransomware | — |
| 2022-03-28 | CVE-2021-26085 | Confluence Server Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. | 2022-04-18 | Ransomware | — |
| 2022-03-07 | CVE-2019-11581 | Jira Server and Data Center Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution. | 2022-09-07 | — | |
| 2021-11-03 | CVE-2021-26084 | Confluence Server and Data Center Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2019-3398 | Confluence Server and Data Center Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote co… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2019-3396 | Confluence Server and Data Server Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2019-11580 | Crowd and Crowd Data Center Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds. | 2022-05-03 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Atlassian vulnerabilities are in the CISA KEV catalog?
14 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-10-15. 1 were added in the last 12 months.
Which Atlassian products have the most exploited vulnerabilities?
By KEV entries: Confluence Data Center and Server (3), Confluence Server and Data Center (2), Jira Server and Data Center (2), Bitbucket Server and Data Center (1), Confluence (1), Confluence Server (1).
Are Atlassian vulnerabilities used in ransomware attacks?
CISA marks 8 of the 14 Atlassian entries as known to be used in ransomware campaigns. The table flags them.
Is the next Atlassian CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Zyxel · Progress · F5