Atlassian

CVEs currently on EVULNABLE's Priority Feed for Atlassian, and this vendor's own CISA KEV history.

CISA KEV additions over time

Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.

20 Apr – 12 Oct; busiest week: 1 added.

1

May

Jun

Jul

Aug

Sep

Oct

Not ransomware-linked
Ransomware-linked
This week (so far)

CISA KEV additions per week, last 26 weeks
Week of	Added to KEV	Ransomware-linked
2026-04-20	0	0
2026-04-27	0	0
2026-05-04	0	0
2026-05-11	0	0
2026-05-18	0	0
2026-05-25	0	0
2026-06-01	0	0
2026-06-08	0	0
2026-06-15	0	0
2026-06-22	0	0
2026-06-29	0	0
2026-07-06	0	0
2026-07-13	0	0
2026-07-20	0	0
2026-07-27	0	0
2026-08-03	0	0
2026-08-10	0	0
2026-08-17	0	0
2026-08-24	0	0
2026-08-31	0	0
2026-09-07	0	0
2026-09-14	0	0
2026-09-21	0	0
2026-09-28	0	0
2026-10-05	0	0
2026-10-12 (so far)	1	0

In EVULNABLE's ranked feed

Showing all 14 Atlassian CVEs in EVULNABLE's ranked feed.

#1 94 Immediate CVE-2021-26084 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗

#2 94 Immediate CVE-2022-26134 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2022-06-02

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗

#3 94 Immediate CVE-2023-22518 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2023-11-07

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#4 94 Immediate CVE-2023-22527 ExigentKEV since 2024 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Confluence Data Center and Server Template Injection Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.98th pctlKEV since2024-01-24

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#5 94 Immediate CVE-2019-3396 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.97th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗

#6 94 Immediate CVE-2023-22515 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.2% · 99.94th pctlKEV since2023-10-05

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#7 92 Immediate CVE-2019-11580 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

EVRS 92/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS95.4% · 99.87th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗

#8 88 Immediate CVE-2021-26085 KEV since 2022 · listed over a yearRansomwareCISA KEV Atlassian — Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability

EVRS 88/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.3 (NVD)EPSS99.9% · 99.97th pctlKEV since2022-03-28

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗

#9 87 Immediate CVE-2022-26138 ExigentKEV since 2022 · listed over a yearCISA KEV Atlassian — Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.2% · 99.92nd pctlKEV since2022-07-29

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.982.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#10 86 Immediate CVE-2022-36804 KEV since 2022 · listed over a yearCISA KEV Atlassian — Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

EVRS 86/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS99.2% · 99.93rd pctlKEV since2022-09-30

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.992.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#11 85 Immediate CVE-2019-3398 KEV since 2021 · listed over a yearCISA KEV Atlassian — Atlassian Confluence Server and Data Center Path Traversal Vulnerability

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS97.0% · 99.89th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.970.

Full CVE page NVD ↗CISA KEV ↗

#12 85 Immediate CVE-2026-21589 ExigentCISA federal deadline in 1 dayCISA KEV Atlassian — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.3 (NVD)EPSS12.7% · 96.2nd pctlKEV since2026-10-15

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.127.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#13 83 Urgent CVE-2019-11581 KEV since 2022 · listed over a yearCISA KEV Atlassian — Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS84.6% · 99.7th pctlKEV since2022-03-07

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.846.

Full CVE page NVD ↗CISA KEV ↗

#14 82 Urgent CVE-2021-26086 KEV since 2024 · listed over a yearCISA KEV Atlassian — Atlassian Jira Server and Data Center Path Traversal Vulnerability

EVRS 82/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.3 (NVD)EPSS99.9% · 99.99th pctlKEV since2024-11-12

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗