Vendor

Atlassian

As of 6 October 2026, 13 Atlassian vulnerabilities are on CISA's list of exploited vulnerabilities, 8 of them used in ransomware campaigns; 0 were added in 2026. Patch first: CVE-2019-3396.

Patch first

Patch first
#	Vulnerability	Product	Our group	Listed	Deadline	EPSS
1	CVE-2019-3396Confluence Server and Data Center Server-Side Template Injection	Atlassian Confluence Server and Data Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry	2021-11-03	2022-05-03	0.99	2021-11-03 · due 2022-05-03
2	CVE-2023-22527Template Injection	Atlassian Confluence Data Center and Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2024-01-24	2024-02-14	0.99	2024-01-24 · due 2024-02-14
3	CVE-2023-22518Improper Authorization	Atlassian Confluence Data Center and Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2023-11-07	2023-11-28	0.99	2023-11-07 · due 2023-11-28
4	CVE-2023-22515Broken Access Control	Atlassian Confluence Data Center and Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2023-10-05	2023-10-13	0.99	2023-10-05 · due 2023-10-13
5	CVE-2022-36804Command Injection	Atlassian Bitbucket Server and Data Center	Patch this weekMetasploit module; EPSS 0.99	2022-09-30	2022-10-21	0.99	2022-09-30 · due 2022-10-21
6	CVE-2022-26134Confluence Server and Data Center Remote Code Execution	Atlassian Confluence Server/Data Center	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2022-06-02	2022-06-06	0.99	2022-06-02 · due 2022-06-06
7	CVE-2019-11580Remote Code Execution	Atlassian Crowd and Crowd Data Center	Patch this weekRansomware use; Metasploit module; EPSS 0.95	2021-11-03	2022-05-03	0.95	2021-11-03 · due 2022-05-03
8	CVE-2021-26084Object-Graph Navigation Language (OGNL) Injection	Atlassian Confluence Server and Data Center	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2021-11-03	2021-11-17	0.99	2021-11-03 · due 2021-11-17
9	CVE-2021-26086Path Traversal	Atlassian Jira Server and Data Center	Patch this weekEPSS 0.99	2024-11-12	2024-12-03	0.99	2024-11-12 · due 2024-12-03
10	CVE-2022-26138Questions For Confluence App Hard-coded Credentials	Atlassian Confluence	Patch this weekEPSS 0.98	2022-07-29	2022-08-19	0.98	2022-07-29 · due 2022-08-19
11	CVE-2021-26085Pre-Authorization Arbitrary File Read	Atlassian Confluence Server	Patch this weekRansomware use; EPSS 0.99	2022-03-28	2022-04-18	0.99	2022-03-28 · due 2022-04-18
12	CVE-2019-11581Server-Side Template Injection	Atlassian Jira Server and Data Center	Patch this weekEPSS 0.85	2022-03-07	2022-09-07	0.85	2022-03-07 · due 2022-09-07
13	CVE-2019-3398Path Traversal	Atlassian Confluence Server and Data Center	Patch this weekEPSS 0.97	2021-11-03	2022-05-03	0.97	2021-11-03 · due 2022-05-03

Products

Confluence Data Center and Server3 entries
Confluence Server and Data Center2 entries
Jira Server and Data Center2 entries
Bitbucket Server and Data Center1 entry
Confluence1 entry
Confluence Server1 entry
Confluence Server and Data Server1 entry
Confluence Server/Data Center1 entry
Crowd and Crowd Data Center1 entry

Added each year

Entries CISA added each year, removed ones included. Source: CISA KEV.

Show the numbers

Period	entries added
2021	4
2022	5
2023	2
2024	2
2025	none
2026	none

Used in ransomware

Changes CISA made to these entries

2025-05-12
CVE-2019-11580 Atlassian Crowd and Crowd Data CenterRansomware use: Unknown to Known.

Every change we recorded