Vendor scorecard
CISA lists 14 Atlassian vulnerabilities as exploited in the wild, 1 of them added in the last 12 months (up from 0 in the 12 months before). 8 (57%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 10 days. Most affected: Confluence Data Center and Server (3), Jira Server and Data Center (2), Confluence Server and Data Center (2).
| Product | KEV entries |
|---|---|
| Confluence Data Center and Server | 3 |
| Jira Server and Data Center | 2 |
| Confluence Server and Data Center | 2 |
| Multiple Products | 1 |
| Bitbucket Server and Data Center | 1 |
| Confluence | 1 |
| Confluence Server/Data Center | 1 |
| Confluence Server | 1 |
| Crowd and Crowd Data Center | 1 |
| Confluence Server and Data Server | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityMultiple Products | |
| CVE-2021-26086 | Atlassian Jira Server and Data Center Path Traversal VulnerabilityJira Server and Data Center | |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server Template Injection VulnerabilityRANSOMWAREConfluence Data Center and Server | |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityRANSOMWAREConfluence Data Center and Server | |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control VulnerabilityRANSOMWAREConfluence Data Center and Server | |
| CVE-2022-36804 | Atlassian Bitbucket Server and Data Center Command Injection VulnerabilityBitbucket Server and Data Center | |
| CVE-2022-26138 | Atlassian Questions For Confluence App Hard-coded Credentials VulnerabilityConfluence | |
| CVE-2022-26134 | Atlassian Confluence Server and Data Center Remote Code Execution VulnerabilityRANSOMWAREConfluence Server/Data Center | |
| CVE-2021-26085 | Atlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityRANSOMWAREConfluence Server | |
| CVE-2019-11581 | Atlassian Jira Server and Data Center Server-Side Template Injection VulnerabilityJira Server and Data Center | |
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection VulnerabilityRANSOMWAREConfluence Server and Data Center | |
| CVE-2019-3398 | Atlassian Confluence Server and Data Center Path Traversal VulnerabilityConfluence Server and Data Center | |
| CVE-2019-3396 | Atlassian Confluence Server and Data Center Server-Side Template Injection VulnerabilityRANSOMWAREConfluence Server and Data Server | |
| CVE-2019-11580 | Atlassian Crowd and Crowd Data Center Remote Code Execution VulnerabilityRANSOMWARECrowd and Crowd Data Center |
Get an email when CISA adds the next Atlassian CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (1 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →