Atlassian vulnerabilities
Vulnerabilities in Atlassian Confluence, Jira, and Bitbucket — frequent ransomware-precursor targets due to the sensitive internal documentation they host.
We track 14 Atlassian CVEs, 14 of them on CISA's Known Exploited Vulnerabilities catalog (8 flagged for ransomware use). The latest KEV addition is CVE-2026-21589, added .
- CVEs tracked
- 14
- On CISA KEV
- 14
- Ransomware use
- 8
- Rated critical
- 10
Most-exploited Atlassian products
Latest Atlassian coverage
Our reporting filed under Atlassian, plus any story that cites one of its CVEs.
Atlassian October Bulletin Covers 75 Flaws, 14 Critical
Atlassian patches 75 flaws in its October bulletin, 14 rated critical, all in third-party components shipped with Data Center and Server products.
Atlassian CVE-2026-21589: Exploits Active, Patch Now
Active exploitation of CVE-2026-21589 began within hours of a public PoC. All eight affected Atlassian Data Center products need patching immediately.
Atlassian Patches Critical Path Traversal Across 8 Products
CVE-2026-21589, CVSS 9.3: unauthenticated path traversal across eight Atlassian Data Center products. Patches released October 6, 2026.
CVE-2023-22515: Three Years of Confluence Exploitation
CVE-2023-22515 gave unauthenticated attackers Confluence admin access. Nearly three years on, EPSS sits at 0.99 — unpatched installs remain active targets.
The Confluence Bug That Became a Ransomware Precursor
CVE-2022-26134 gave unauthenticated attackers remote code execution on any exposed Confluence instance — and became a go-to foothold for ransomware operators within days of disclosure.
Known exploited Atlassian vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-21589 Path traversal allows unauthenticated file read in eight Atlassian Data Center productswrite-up | [ CRITICAL ] | 9.3 | 99.7% | ||
| CVE-2021-26086 Atlassian Jira Server and Data Center Path Traversal Vulnerability | [ MEDIUM ] | 5.3 | 100.0% | ||
| CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2023-22518 Atlassian Confluence Data Center and Server Improper Authorization Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2023-22515 Atlassian Confluence Data Center and Server Broken Access Controlransomware usewrite-up | [ CRITICAL ] | 9.8 | 99.2% | ||
| CVE-2022-36804 Atlassian Bitbucket Server and Data Center Command Injection Vulnerability | [ HIGH ] | 8.8 | 99.0% | ||
| CVE-2022-26138 Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability | [ CRITICAL ] | 9.8 | 98.2% | ||
| CVE-2022-26134 Atlassian Confluence OGNL Injection Remote Code Executionransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2021-26085 Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerabilityransomware use | [ MEDIUM ] | 5.3 | 99.9% | ||
| CVE-2019-11581 Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability | [ CRITICAL ] | 9.8 | 84.6% | ||
| CVE-2021-26084 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2019-3398 Atlassian Confluence Server and Data Center Path Traversal Vulnerability | [ HIGH ] | 8.8 | 97.0% | ||
| CVE-2019-3396 Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.9% | ||
| CVE-2019-11580 Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 95.4% |
Every Atlassian CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Machine-readable: /api/v1/vendors/atlassian.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.