Atlassian vulnerabilities13 known to be exploited.
Atlassian has 459 published vulnerabilities across 63 products in our catalogue. 13 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Jira, with 143. If you run Atlassian software, patch the exploited flaws first.
The most recent Atlassian flaw added to the known-exploited list is CVE-2021-26086, on 12 November 2024. We keep watching the known-exploited list.
Which Atlassian products have the most vulnerabilities?
Jira leads with 143 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Atlassian vulnerabilities are being exploited?
13 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 5.3Atlassian Jira Server and Data Center Path Traversal Vulnerability
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
- 9.8Atlassian Confluence Data Center and Server Template Injection Vulnerability
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
- 9.8Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker.
- 9.8Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
- 8.8Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private...
- 9.8Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext.
- 9.8Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
- 5.3Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
Which Atlassian flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.
- >99%
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
- >99%
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
- >99%
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint.
- >99%
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance.
- >99%
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint.
- >99%
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the...
- >99%CVE-2020-14181Medium
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint.
- >99%
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server...
- >99%CVE-2020-36289Medium
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.
All Atlassian products we track.
59 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Jirajira143 vulnerabilities423 versions
- Jira Serverjira_server134 vulnerabilities304 versions
- Jira Data Centerjira_data_center78 vulnerabilities329 versions
- Cruciblecrucible52 vulnerabilities205 versions
- Fisheyefisheye52 vulnerabilities207 versions
- Confluence Serverconfluence_server47 vulnerabilities490 versions
- Data Centerdata_center39 vulnerabilities42 versions
- Jira Software Data Centerjira_software_data_center39 vulnerabilities202 versions
- Confluence Data Centerconfluence_data_center34 vulnerabilities548 versions
- Bamboobamboo24 vulnerabilities266 versions
- Crowdcrowd23 vulnerabilities230 versions
- Bitbucketbitbucket20 vulnerabilities493 versions
- Confluenceconfluence19 vulnerabilities412 versions
- Jira Service Managementjira_service_management16 vulnerabilities90 versions
- Sourcetreesourcetree14 vulnerabilities355 versions
- Jira Alignjira_align13 vulnerabilities65 versions
- Jira Service Deskjira_service_desk12 vulnerabilities195 versions
- Application Linksapplication_links7 vulnerabilities76 versions
- Hipchathipchat5 vulnerabilities35 versions
- Floodlightfloodlight4 vulnerabilities6 versions
- Companioncompanion3 vulnerabilities20 versions
- Hipchat Serverhipchat_server3 vulnerabilities12 versions
- Questions for Confluencequestions_for_confluence3 vulnerabilities47 versions
- Universal Plugin Manageruniversal_plugin_manager3 vulnerabilities143 versions
This directory lists the 59 Atlassian products with at least one tracked version, of 63 in our catalogue.
Running Atlassian? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
- Matched to
- Jira on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 459 published vulnerabilities across 63 products and 8,031 versions from Atlassian. The most recent Atlassian flaw added to the known-exploited list is CVE-2021-26086, on 12 November 2024.
13 Atlassian vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-26086, CVE-2023-22527 and CVE-2023-22518. The full list is on this page.
Jira, with 143 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Atlassian products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.