Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

Atlassian: actively exploited vulnerabilities

13 vulnerabilities in Atlassian products are listed in CISA’s catalog of actively exploited vulnerabilities, 8 of them used by ransomware. Latest addition on November 12, 2024: CVE-2021-26086 (Jira Server and Data Center).

Affected products

  • Confluence Data Center and Server3
  • Confluence Server and Data Center2
  • Jira Server and Data Center2
  • Bitbucket Server and Data Center1
  • Confluence1
  • Confluence Server1
  • Confluence Server and Data Server1
  • Confluence Server/Data Center1
  • Crowd and Crowd Data Center1

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

  1. CERTFR-2026-AVI-1264

    Vulnérabilité dans les produits Atlassian (06 octobre 2026)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2024 2 vulnerabilities

  1. CVE-2021-26086

    Atlassian Jira Server and Data Center Path Traversal Vulnerability

    NVD entryCISA catalog

  2. CVE-2023-22527Used by ransomware

    Atlassian Confluence Data Center and Server Template Injection Vulnerability

    NVD entryCISA catalog

2023 2 vulnerabilities

  1. CVE-2023-22518Used by ransomware

    Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

    NVD entryCISA catalog

  2. CVE-2023-22515Used by ransomware

    Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

    NVD entryCISA catalog

2022 5 vulnerabilities

  1. CVE-2022-36804

    Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2022-26138

    Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

    NVD entryCISA catalog

  3. CVE-2022-26134Used by ransomware

    Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

    NVD entryCISA catalog

  4. CVE-2021-26085Used by ransomware

    Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability

    NVD entryCISA catalog

  5. CVE-2019-11581

    Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

    NVD entryCISA catalog

2021 4 vulnerabilities

  1. CVE-2021-26084Used by ransomware

    Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2019-3398

    Atlassian Confluence Server and Data Center Path Traversal Vulnerability

    NVD entryCISA catalog

  3. CVE-2019-3396Used by ransomware

    Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

    NVD entryCISA catalog

  4. CVE-2019-11580Used by ransomware

    Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.