# Atlassian vulnerabilities

> Atlassian has 459 published vulnerabilities across 63 products in our catalogue. 13 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Jira, with 143. If you run Atlassian software, patch the exploited flaws first.

Canonical page: https://www.precursorintelligence.com/vendors/atlassian

## At a glance

- **Published vulnerabilities:** 459
- **Known to be exploited:** 13
- **Products:** 63
- **Versions:** 8,031
- **Most recently added to the known-exploited list:** [CVE-2021-26086](https://www.precursorintelligence.com/what-is/cve-2021-26086), 12 November 2024. We keep watching the list.

## Which Atlassian products have the most vulnerabilities?

- [Jira](https://www.precursorintelligence.com/product/atlassian/jira): 143 published vulnerabilities, 423 versions
- [Jira Server](https://www.precursorintelligence.com/product/atlassian/jira_server): 134 published vulnerabilities, 304 versions
- [Jira Data Center](https://www.precursorintelligence.com/product/atlassian/jira_data_center): 78 published vulnerabilities, 329 versions
- [Crucible](https://www.precursorintelligence.com/product/atlassian/crucible): 52 published vulnerabilities, 205 versions
- [Fisheye](https://www.precursorintelligence.com/product/atlassian/fisheye): 52 published vulnerabilities, 207 versions
- [Confluence Server](https://www.precursorintelligence.com/product/atlassian/confluence_server): 47 published vulnerabilities, 490 versions
- [Data Center](https://www.precursorintelligence.com/product/atlassian/data_center): 39 published vulnerabilities, 42 versions
- [Jira Software Data Center](https://www.precursorintelligence.com/product/atlassian/jira_software_data_center): 39 published vulnerabilities, 202 versions
- [Confluence Data Center](https://www.precursorintelligence.com/product/atlassian/confluence_data_center): 34 published vulnerabilities, 548 versions
- [Bamboo](https://www.precursorintelligence.com/product/atlassian/bamboo): 24 published vulnerabilities, 266 versions

Each product page lists its own known-exploited flaws.

## Which Atlassian vulnerabilities are being exploited?

13 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2021-26086](https://www.precursorintelligence.com/what-is/cve-2021-26086): Atlassian Jira Server and Data Center Path Traversal Vulnerability. Medium, CVSS 5.3, chance of use in 30 days >99%, known exploited since 12 November 2024.
- [CVE-2023-22527](https://www.precursorintelligence.com/what-is/cve-2023-22527): Atlassian Confluence Data Center and Server Template Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 24 January 2024.
- [CVE-2023-22518](https://www.precursorintelligence.com/what-is/cve-2023-22518): Atlassian Confluence Data Center and Server Improper Authorization Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 7 November 2023.
- [CVE-2023-22515](https://www.precursorintelligence.com/what-is/cve-2023-22515): Atlassian Confluence Data Center and Server Broken Access Control Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 5 October 2023.
- [CVE-2022-36804](https://www.precursorintelligence.com/what-is/cve-2022-36804): Atlassian Bitbucket Server and Data Center Command Injection Vulnerability. High, CVSS 8.8, chance of use in 30 days >99%, known exploited since 30 September 2022.
- [CVE-2022-26138](https://www.precursorintelligence.com/what-is/cve-2022-26138): Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 98%, known exploited since 29 July 2022.
- [CVE-2022-26134](https://www.precursorintelligence.com/what-is/cve-2022-26134): Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 2 June 2022.
- [CVE-2021-26085](https://www.precursorintelligence.com/what-is/cve-2021-26085): Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability. Medium, CVSS 5.3, chance of use in 30 days >99%, known exploited since 28 March 2022.
- [CVE-2019-11581](https://www.precursorintelligence.com/what-is/cve-2019-11581): Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 85%, known exploited since 7 March 2022.
- [CVE-2019-11580](https://www.precursorintelligence.com/what-is/cve-2019-11580): Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 95%, known exploited since 3 November 2021.
- [CVE-2021-26084](https://www.precursorintelligence.com/what-is/cve-2021-26084): Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2019-3396](https://www.precursorintelligence.com/what-is/cve-2019-3396): Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2019-3398](https://www.precursorintelligence.com/what-is/cve-2019-3398): Atlassian Confluence Server and Data Center Path Traversal Vulnerability. High, CVSS 8.8, chance of use in 30 days 97%, known exploited since 3 November 2021.

## Which Atlassian flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2023-22518](https://www.precursorintelligence.com/what-is/cve-2023-22518): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2022-26134](https://www.precursorintelligence.com/what-is/cve-2022-26134): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2021-26084](https://www.precursorintelligence.com/what-is/cve-2021-26084): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2021-26086](https://www.precursorintelligence.com/what-is/cve-2021-26086): >99%, Medium (CVSS 5.3), known exploited
- [CVE-2023-22527](https://www.precursorintelligence.com/what-is/cve-2023-22527): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2021-26085](https://www.precursorintelligence.com/what-is/cve-2021-26085): >99%, Medium (CVSS 5.3), known exploited
- [CVE-2019-3396](https://www.precursorintelligence.com/what-is/cve-2019-3396): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2020-14181](https://www.precursorintelligence.com/what-is/cve-2020-14181): >99%, Medium (CVSS 5.3)
- [CVE-2023-22515](https://www.precursorintelligence.com/what-is/cve-2023-22515): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2020-36289](https://www.precursorintelligence.com/what-is/cve-2020-36289): >99%, Medium (CVSS 5.3)

## All Atlassian products we track

59 products with at least one tracked version, most vulnerabilities first:

- [Jira](https://www.precursorintelligence.com/product/atlassian/jira): 143 vulnerabilities, 423 versions
- [Jira Server](https://www.precursorintelligence.com/product/atlassian/jira_server): 134 vulnerabilities, 304 versions
- [Jira Data Center](https://www.precursorintelligence.com/product/atlassian/jira_data_center): 78 vulnerabilities, 329 versions
- [Crucible](https://www.precursorintelligence.com/product/atlassian/crucible): 52 vulnerabilities, 205 versions
- [Fisheye](https://www.precursorintelligence.com/product/atlassian/fisheye): 52 vulnerabilities, 207 versions
- [Confluence Server](https://www.precursorintelligence.com/product/atlassian/confluence_server): 47 vulnerabilities, 490 versions
- [Data Center](https://www.precursorintelligence.com/product/atlassian/data_center): 39 vulnerabilities, 42 versions
- [Jira Software Data Center](https://www.precursorintelligence.com/product/atlassian/jira_software_data_center): 39 vulnerabilities, 202 versions
- [Confluence Data Center](https://www.precursorintelligence.com/product/atlassian/confluence_data_center): 34 vulnerabilities, 548 versions
- [Bamboo](https://www.precursorintelligence.com/product/atlassian/bamboo): 24 vulnerabilities, 266 versions
- [Crowd](https://www.precursorintelligence.com/product/atlassian/crowd): 23 vulnerabilities, 230 versions
- [Bitbucket](https://www.precursorintelligence.com/product/atlassian/bitbucket): 20 vulnerabilities, 493 versions
- [Confluence](https://www.precursorintelligence.com/product/atlassian/confluence): 19 vulnerabilities, 412 versions
- [Jira Service Management](https://www.precursorintelligence.com/product/atlassian/jira_service_management): 16 vulnerabilities, 90 versions
- [Sourcetree](https://www.precursorintelligence.com/product/atlassian/sourcetree): 14 vulnerabilities, 355 versions
- [Jira Align](https://www.precursorintelligence.com/product/atlassian/jira_align): 13 vulnerabilities, 65 versions
- [Jira Service Desk](https://www.precursorintelligence.com/product/atlassian/jira_service_desk): 12 vulnerabilities, 195 versions
- [Application Links](https://www.precursorintelligence.com/product/atlassian/application_links): 7 vulnerabilities, 76 versions
- [Hipchat](https://www.precursorintelligence.com/product/atlassian/hipchat): 5 vulnerabilities, 35 versions
- [Floodlight](https://www.precursorintelligence.com/product/atlassian/floodlight): 4 vulnerabilities, 6 versions
- [Hipchat Server](https://www.precursorintelligence.com/product/atlassian/hipchat_server): 3 vulnerabilities, 12 versions
- [Companion](https://www.precursorintelligence.com/product/atlassian/companion): 3 vulnerabilities, 20 versions
- [Universal Plugin Manager](https://www.precursorintelligence.com/product/atlassian/universal_plugin_manager): 3 vulnerabilities, 143 versions
- [Questions for Confluence](https://www.precursorintelligence.com/product/atlassian/questions_for_confluence): 3 vulnerabilities, 47 versions
- [SAML Single Sign on](https://www.precursorintelligence.com/product/atlassian/saml_single_sign_on): 2 vulnerabilities, 66 versions
- [Crowd2](https://www.precursorintelligence.com/product/atlassian/crowd2): 2 vulnerabilities, 12 versions
- [Connect Spring Boot](https://www.precursorintelligence.com/product/atlassian/connect_spring_boot): 2 vulnerabilities, 29 versions
- [Assets Discovery Data Center](https://www.precursorintelligence.com/product/atlassian/assets_discovery_data_center): 2 vulnerabilities, 30 versions
- [Bitbucket Data Center](https://www.precursorintelligence.com/product/atlassian/bitbucket_data_center): 2 vulnerabilities, 30 versions
- [Navigator Links](https://www.precursorintelligence.com/product/atlassian/navigator_links): 1 vulnerability, 7 versions
- [Alfresco Enterprise Content Management](https://www.precursorintelligence.com/product/atlassian/alfresco_enterprise_content_management): 1 vulnerability, 1 version
- [Assets Discovery Cloud](https://www.precursorintelligence.com/product/atlassian/assets_discovery_cloud): 1 vulnerability, 43 versions
- [Assets Discovery Data Server](https://www.precursorintelligence.com/product/atlassian/assets_discovery_data_server): 1 vulnerability, 20 versions
- [Atlasboard](https://www.precursorintelligence.com/product/atlassian/atlasboard): 1 vulnerability, 33 versions
- [Automation for Jira](https://www.precursorintelligence.com/product/atlassian/automation_for_jira): 1 vulnerability, 55 versions
- [Bitbucket Auto Unapprove Plugin](https://www.precursorintelligence.com/product/atlassian/bitbucket_auto_unapprove_plugin): 1 vulnerability, 10 versions
- [Bitbucket Server](https://www.precursorintelligence.com/product/atlassian/bitbucket_server): 1 vulnerability, 29 versions
- [Cloudtoken](https://www.precursorintelligence.com/product/atlassian/cloudtoken): 1 vulnerability, 29 versions
- [Connect Express](https://www.precursorintelligence.com/product/atlassian/connect_express): 1 vulnerability, 70 versions
- [Editor-Core](https://www.precursorintelligence.com/product/atlassian/editor-core): 1 vulnerability, 2,060 versions
- [Floodlight Controller](https://www.precursorintelligence.com/product/atlassian/floodlight_controller): 1 vulnerability, 6 versions
- [Greenhopper](https://www.precursorintelligence.com/product/atlassian/greenhopper): 1 vulnerability, 1 version
- [Hipchat Data Center](https://www.precursorintelligence.com/product/atlassian/hipchat_data_center): 1 vulnerability, 9 versions
- [Html Include and Replace Macro](https://www.precursorintelligence.com/product/atlassian/html_include_and_replace_macro): 1 vulnerability, 5 versions
- [HTTP Library](https://www.precursorintelligence.com/product/atlassian/http_library): 1 vulnerability, 1 version
- [Jira Comment](https://www.precursorintelligence.com/product/atlassian/jira_comment): 1 vulnerability, 1 version
- [Jira Core](https://www.precursorintelligence.com/product/atlassian/jira_core): 1 vulnerability, 1 version
- [Jira Create](https://www.precursorintelligence.com/product/atlassian/jira_create): 1 vulnerability, 5 versions
- [Jira Integration for Hipchat](https://www.precursorintelligence.com/product/atlassian/jira_integration_for_hipchat): 1 vulnerability, 13 versions
- [Jira Server and Data Center](https://www.precursorintelligence.com/product/atlassian/jira_server_and_data_center): 1 vulnerability, 12 versions
- [Jira Server for Slack](https://www.precursorintelligence.com/product/atlassian/jira_server_for_slack): 1 vulnerability, 28 versions
- [Activity Streams](https://www.precursorintelligence.com/product/atlassian/activity_streams): 1 vulnerability, 1 version
- [Oauth](https://www.precursorintelligence.com/product/atlassian/oauth): 1 vulnerability, 39 versions
- [Subversion Application Lifecycle Management](https://www.precursorintelligence.com/product/atlassian/subversion_application_lifecycle_management): 1 vulnerability, 1 version
- [Troubleshooting and Support](https://www.precursorintelligence.com/product/atlassian/troubleshooting_and_support): 1 vulnerability, 35 versions
- [Jira-Integration-Spi](https://www.precursorintelligence.com/product/atlassian/jira-integration-spi): 0 vulnerabilities, 20 versions
- [Bitbucket Auto Unapprove](https://www.precursorintelligence.com/product/atlassian/bitbucket_auto_unapprove): 0 vulnerabilities, 10 versions
- [Jira Service Management Server and Data Center](https://www.precursorintelligence.com/product/atlassian/jira_service_management_server_and_data_center): 0 vulnerabilities, 1 version
- [Jira Service Desk Server](https://www.precursorintelligence.com/product/atlassian/jira_service_desk_server): 0 vulnerabilities, 123 versions

## Questions

### How many vulnerabilities does Atlassian have?

Our catalogue lists 459 published vulnerabilities across 63 products and 8,031 versions from Atlassian. The most recent Atlassian flaw added to the known-exploited list is CVE-2021-26086, on 12 November 2024.

### Which Atlassian vulnerabilities are being exploited?

13 Atlassian vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-26086, CVE-2023-22527 and CVE-2023-22518. The full list is on this page.

### Which Atlassian product has the most vulnerabilities?

Jira, with 143 published vulnerabilities. Its own page lists the ones known to be exploited.

### How do I get alerts for new Atlassian vulnerabilities?

Create a Precursor Intelligence account and track the Atlassian products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

## Running Atlassian?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact