Atlassian: exploited vulnerabilities

14exploited vulnerabilities
8used by ransomware
Oct 15, 2026latest one added

Confluence Data Center and Server 3
Jira Server and Data Center 2
Confluence Server and Data Center 2
Multiple Products 1
Bitbucket Server and Data Center 1
Confluence 1
Confluence Server/Data Center 1
Confluence Server 1
Confluence Server and Data Server 1
Crowd and Crowd Data Center 1

Added	Vulnerability	Product	Severity	Attack chance
Oct 15, 2026	Files or Directories Accessible to External PartiesCVE-2026-21589	Multiple Products	Critical 9.3	99.5%
Nov 12, 2024	Path TraversalCVE-2021-26086	Jira Server and Data Center	Medium 5.3	>99.9%
Jan 24, 2024	Template InjectionCVE-2023-22527used by ransomware	Confluence Data Center and Server	Critical 10.0	>99.9%
Nov 7, 2023	Improper AuthorizationCVE-2023-22518used by ransomware	Confluence Data Center and Server	Critical 10.0	>99.9%
Oct 5, 2023	Broken Access ControlCVE-2023-22515used by ransomware	Confluence Data Center and Server	Critical 10.0	99.2%
Sep 30, 2022	Command InjectionCVE-2022-36804	Bitbucket Server and Data Center	High 8.8	99.1%
Jul 29, 2022	Questions For Confluence App Hard-coded CredentialsCVE-2022-26138	Confluence	Critical 9.8	98%
Jun 2, 2022	Confluence Server and Data Center Remote Code ExecutionCVE-2022-26134used by ransomware	Confluence Server/Data Center	Critical 9.8	>99.9%
Mar 28, 2022	Pre-Authorization Arbitrary File ReadCVE-2021-26085used by ransomware	Confluence Server	Medium 5.3	99.9%
Mar 7, 2022	Server-Side Template InjectionCVE-2019-11581	Jira Server and Data Center	Critical 9.8	85%
Nov 3, 2021	Object-Graph Navigation Language (OGNL) InjectionCVE-2021-26084used by ransomware	Confluence Server and Data Center	Critical 9.8	>99.9%
Nov 3, 2021	Path TraversalCVE-2019-3398	Confluence Server and Data Center	High 8.8	97%
Nov 3, 2021	Confluence Server and Data Center Server-Side Template InjectionCVE-2019-3396used by ransomware	Confluence Server and Data Server	Critical 9.8	99.9%
Nov 3, 2021	Remote Code ExecutionCVE-2019-11580used by ransomware	Crowd and Crowd Data Center	Critical 9.8	95%

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.