Exploited vulnerabilities
Atlassian
14 Atlassian vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue14
Last 12 months1
In ransomware campaigns8
Last addition15 October 2026
The vulnerabilities14
- 15 October 2026CVE-2026-21589Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- 12 November 2024CVE-2021-26086Jira Server and Data CenterAtlassian Jira Server and Data Center Path Traversal Vulnerability
- 24 January 2024CVE-2023-22527Confluence Data Center and ServerAtlassian Confluence Data Center and Server Template Injection VulnerabilityRansomware
- 7 November 2023CVE-2023-22518Confluence Data Center and ServerAtlassian Confluence Data Center and Server Improper Authorization VulnerabilityRansomware
- 5 October 2023CVE-2023-22515Confluence Data Center and ServerAtlassian Confluence Data Center and Server Broken Access Control VulnerabilityRansomware
- 30 September 2022CVE-2022-36804Bitbucket Server and Data CenterAtlassian Bitbucket Server and Data Center Command Injection Vulnerability
- 29 July 2022CVE-2022-26138ConfluenceAtlassian Questions For Confluence App Hard-coded Credentials Vulnerability
- 2 June 2022CVE-2022-26134Confluence Server/Data CenterAtlassian Confluence Server and Data Center Remote Code Execution VulnerabilityRansomware
- 28 March 2022CVE-2021-26085Confluence ServerAtlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityRansomware
- 7 March 2022CVE-2019-11581Jira Server and Data CenterAtlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
- 3 November 2021CVE-2021-26084Confluence Server and Data CenterAtlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection VulnerabilityRansomware
- 3 November 2021CVE-2019-3398Confluence Server and Data CenterAtlassian Confluence Server and Data Center Path Traversal Vulnerability
- 3 November 2021CVE-2019-3396Confluence Server and Data ServerAtlassian Confluence Server and Data Center Server-Side Template Injection VulnerabilityRansomware
- 3 November 2021CVE-2019-11580Crowd and Crowd Data CenterAtlassian Crowd and Crowd Data Center Remote Code Execution VulnerabilityRansomware
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, Atlassian included.