Atlassian known exploited vulnerabilities

CISA's Known Exploited Vulnerabilities catalog lists 14 Atlassian vulnerabilities: 1 added in the last 365 days, 10 rated critical (CVSS 9 or higher), and 8 with known ransomware use. The most recent was added Oct 15, 2026.

RSS feed for Atlassian exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant

Added to KEV	CVE	Vulnerability	CVSS	EPSS	Federal due date	Ransomware use
2026-10-15	CVE-2026-21589	Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability	9.3 (v4.0)	99.5%	2026-10-18	Unknown
2024-11-12	CVE-2021-26086	Atlassian Jira Server and Data Center Path Traversal Vulnerability	5.3 (v3.1)	>99.9%	2024-12-03	Unknown
2024-01-24	CVE-2023-22527	Atlassian Confluence Data Center and Server Template Injection Vulnerability	10 (v3.0)	>99.9%	2024-02-14	Known
2023-11-07	CVE-2023-22518	Atlassian Confluence Data Center and Server Improper Authorization Vulnerability	10 (v3.0)	>99.9%	2023-11-28	Known
2023-10-05	CVE-2023-22515	Atlassian Confluence Data Center and Server Broken Access Control Vulnerability	10 (v3.0)	99.2%	2023-10-13	Known
2022-09-30	CVE-2022-36804	Atlassian Bitbucket Server and Data Center Command Injection Vulnerability	8.8 (v3.1)	99.1%	2022-10-21	Unknown
2022-07-29	CVE-2022-26138	Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability	9.8 (v3.1)	98.2%	2022-08-19	Unknown
2022-06-02	CVE-2022-26134	Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability	9.8 (v3.1)	>99.9%	2022-06-06	Known
2022-03-28	CVE-2021-26085	Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability	5.3 (v3.1)	>99.9%	2022-04-18	Known
2022-03-07	CVE-2019-11581	Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability	9.8 (v3.1)	84.6%	2022-09-07	Unknown
2021-11-03	CVE-2019-11580	Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability	9.8 (v3.1)	95.4%	2022-05-03	Known
2021-11-03	CVE-2019-3396	Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability	9.8 (v3.1)	>99.9%	2022-05-03	Known
2021-11-03	CVE-2019-3398	Atlassian Confluence Server and Data Center Path Traversal Vulnerability	8.8 (v3.1)	97.0%	2022-05-03	Unknown
2021-11-03	CVE-2021-26084	Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability	9.8 (v3.1)	>99.9%	2021-11-17	Known