Brand

Atlassian: actively exploited vulnerabilities

13 vulnerabilities in Atlassian products (Confluence Server / Data Center, Jira Server / Data Center, Bitbucket Server / Data Center…) are in CISA’s catalog of exploited vulnerabilities. Last added: November 12, 2024.

Atlassian security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

0 vulnerabilities added in the last 12 months
13 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one Atlassian category to your radar, or open its page.

Collaboration, telephony and video conferencing 11 vulnerabilities
Development and CI/CD 1 vulnerability
Identity and access 1 vulnerability

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Confluence Server / Data Center 9 vulnerabilities · Collaboration and video
Jira Server / Data Center 2 vulnerabilities · Collaboration and video
Bitbucket Server / Data Center 1 vulnerability · Development and CI/CD
Crowd 1 vulnerability · Identity and access

Name used by CISA: Atlassian. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Atlassian list.

Rank 1Atlassian Confluence Server / Data Center
CVE-2023-22527
Ransomware
Atlassian Confluence Data Center and Server Template Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Jan 24, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 2Atlassian Confluence Server / Data Center
CVE-2023-22518
Ransomware
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 7, 2023
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 3Atlassian Confluence Server / Data Center
CVE-2023-22515
Ransomware
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Added more than a year ago: ranked by severity.
Added
Oct 5, 2023
CISA deadline
8 days
CVSS severity
9.8 (critical)
Rank 4Atlassian Confluence Server / Data Center
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Added more than a year ago: ranked by severity.
Added
Jul 29, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 5Atlassian Confluence Server / Data Center
CVE-2022-26134
Ransomware
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 2, 2022
CISA deadline
4 days
CVSS severity
9.8 (critical)
Rank 6Atlassian Jira Server / Data Center
CVE-2019-11581
CVE from 2019, added in 2022
Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 7, 2022
CISA deadline
184 days
CVSS severity
9.8 (critical)
Rank 7Atlassian Crowd
CVE-2019-11580
RansomwareCVE from 2019, added in 2021
Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 8Atlassian Confluence Server / Data Center
CVE-2019-3396
RansomwareCVE from 2019, added in 2021
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 9Atlassian Confluence Server / Data Center
CVE-2021-26084
Ransomware
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 10Atlassian Bitbucket Server / Data Center
CVE-2022-36804
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 30, 2022
CISA deadline
21 days
CVSS severity
8.8 (high)

Show 3 more vulnerabilities

Rank 11Atlassian Confluence Server / Data Center
CVE-2019-3398
CVE from 2019, added in 2021
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
8.8 (high)
Rank 12Atlassian Jira Server / Data Center
CVE-2021-26086
CVE from 2021, added in 2024
Atlassian Jira Server and Data Center Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 12, 2024
CISA deadline
21 days
CVSS severity
5.3 (medium)
Rank 13Atlassian Confluence Server / Data Center
CVE-2021-26085
Ransomware
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 28, 2022
CISA deadline
21 days
CVSS severity
5.3 (medium)

Get new Atlassian vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

By category

Affected products

Patch first

Follow and verify