{"schema_version":1,"title":"Atlassian vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 25 vulnerabilities in Atlassian: 2 in the last 7 days and 8 in the last 90 days, 13 of them critical and 13 exploited in the wild. The most recent, CVE-2026-77270, was published on 22 September 2026. 4 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/atlassian","json_url":"https://junglewise.ai/threats/vendors/atlassian.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/atlassian","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":3,"all_time":25,"critical":13,"exploited":13,"last_7_days":2,"last_30_days":5,"last_90_days":8,"last_365_days":9},"latest":[{"cve":"CVE-2026-77270","cvss":6.5,"epss":0.004,"slug":"cve-2026-77270-atlassian-mcp-arbitrary-file-read-via-upload-attachment-tools","title":"MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira and Confluenc","severity":"medium","exploited":false,"published_at":"2026-09-22T18:17:18.947+00:00","url":"https://junglewise.ai/threats/cve-2026-77270-atlassian-mcp-arbitrary-file-read-via-upload-attachment-tools"},{"cve":"CVE-2026-77265","cvss":5.9,"epss":0.0026,"slug":"cve-2026-77265-atlassian-mcp-server-ssrf-via-dns-rebinding-in-header","title":"MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira o","severity":"medium","exploited":false,"published_at":"2026-09-22T18:17:18.647+00:00","url":"https://junglewise.ai/threats/cve-2026-77265-atlassian-mcp-server-ssrf-via-dns-rebinding-in-header"},{"cve":"CVE-2026-21588","cvss":7.1,"epss":0.0029,"slug":"cve-2026-21588-atlassian-confluence-data-center-dos-in-authenticated-request","title":"Atlassian Confluence Data Center DoS in authenticated request handling","severity":"info","exploited":false,"published_at":"2026-09-15T17:17:12.02+00:00","url":"https://junglewise.ai/threats/cve-2026-21588-atlassian-confluence-data-center-dos-in-authenticated-request"},{"cve":"CVE-2026-21587","cvss":7.1,"epss":0.0032,"slug":"cve-2026-21587-atlassian-jira-service-management-data-center-improper","title":"Atlassian Jira Service Management Data Center improper authorization","severity":"info","exploited":false,"published_at":"2026-09-15T17:17:11.893+00:00","url":"https://junglewise.ai/threats/cve-2026-21587-atlassian-jira-service-management-data-center-improper"},{"cve":"CVE-2026-21586","cvss":7.1,"epss":0.0032,"slug":"cve-2026-21586-atlassian-confluence-data-center-improper-authorization","title":"Atlassian Confluence Data Center improper authorization","severity":"info","exploited":false,"published_at":"2026-09-15T17:17:11.58+00:00","url":"https://junglewise.ai/threats/cve-2026-21586-atlassian-confluence-data-center-improper-authorization"},{"cve":"CVE-2026-21579","cvss":8.2,"slug":"cve-2026-21579-atlassian-confluence-data-center-information-disclosure","title":"Atlassian Confluence Data Center information disclosure","severity":"info","exploited":false,"published_at":"2026-07-21T18:16:57.487+00:00","url":"https://junglewise.ai/threats/cve-2026-21579-atlassian-confluence-data-center-information-disclosure"},{"cve":"CVE-2026-21577","cvss":7.1,"slug":"cve-2026-21577-atlassian-confluence-data-center-denial-of-service","title":"Atlassian Confluence Data Center denial of service","severity":"info","exploited":false,"published_at":"2026-07-21T18:16:57.327+00:00","url":"https://junglewise.ai/threats/cve-2026-21577-atlassian-confluence-data-center-denial-of-service"},{"cve":"CVE-2026-21575","cvss":7.1,"slug":"cve-2026-21575-atlassian-sourcetree-remote-code-execution","title":"Atlassian Sourcetree remote code execution","severity":"high","exploited":false,"published_at":"2026-07-21T18:16:57.17+00:00","url":"https://junglewise.ai/threats/cve-2026-21575-atlassian-sourcetree-remote-code-execution"},{"cve":"CVE-2026-21570","cvss":8.8,"epss":0.0057,"slug":"cve-2026-21570-atlassian-bamboo-data-center-rce-in-apache-struts","title":"Atlassian Bamboo Data Center RCE in Apache Struts","severity":"high","exploited":false,"published_at":"2026-03-17T18:16:14.87+00:00","url":"https://junglewise.ai/threats/cve-2026-21570-atlassian-bamboo-data-center-rce-in-apache-struts"},{"cve":"CVE-2021-26086","cvss":5.3,"slug":"cve-2021-26086-atlassian-jira-server-and-data-center-path-traversal","title":"Atlassian Jira Server and Data Center Path Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2024-11-12T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-26086-atlassian-jira-server-and-data-center-path-traversal"},{"cve":"CVE-2023-22527","cvss":10,"slug":"cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection","title":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2024-01-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection"},{"cve":"CVE-2023-22518","cvss":10,"slug":"cve-2023-22518-atlassian-confluence-data-center-and-server-improper","title":"Atlassian Confluence Data Center and Server Improper Authorization Vulnerability","severity":"critical","exploited":true,"published_at":"2023-11-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22518-atlassian-confluence-data-center-and-server-improper"},{"cve":"CVE-2023-22515","cvss":10,"slug":"cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control","title":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","severity":"critical","exploited":true,"published_at":"2023-10-05T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control"},{"cve":"CVE-2022-36804","cvss":8.8,"slug":"cve-2022-36804-atlassian-bitbucket-server-and-data-center-command-injection","title":"Atlassian Bitbucket Server and Data Center Command Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2022-09-30T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-36804-atlassian-bitbucket-server-and-data-center-command-injection"},{"cve":"CVE-2022-26138","cvss":9.8,"slug":"cve-2022-26138-atlassian-questions-for-confluence-app-hard-coded-credentials","title":"Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability","severity":"critical","exploited":true,"published_at":"2022-07-29T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-26138-atlassian-questions-for-confluence-app-hard-coded-credentials"},{"cve":"CVE-2022-26134","cvss":9.8,"slug":"cve-2022-26134-atlassian-confluence-server-and-data-center-remote-code-execution","title":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-06-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-26134-atlassian-confluence-server-and-data-center-remote-code-execution"},{"cve":"CVE-2021-26073","cvss":3.1,"epss":0.0092,"slug":"cve-2021-26073-atlassian-connect-express-broken-jwt-authentication","title":"Atlassian Connect Express broken JWT authentication","severity":"low","exploited":false,"published_at":"2022-05-24T22:28:12+00:00","url":"https://junglewise.ai/threats/cve-2021-26073-atlassian-connect-express-broken-jwt-authentication"},{"cve":"CVE-2021-26085","cvss":5.3,"slug":"cve-2021-26085-atlassian-confluence-server-pre-authorization-arbitrary-file-read","title":"Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-28T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-26085-atlassian-confluence-server-pre-authorization-arbitrary-file-read"},{"cve":"CVE-2019-11581","cvss":9.8,"slug":"cve-2019-11581-atlassian-jira-server-and-data-center-server-side-template","title":"Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-11581-atlassian-jira-server-and-data-center-server-side-template"},{"cve":"CVE-2019-3398","cvss":8.8,"slug":"cve-2019-3398-atlassian-confluence-server-and-data-center-path-traversal","title":"Atlassian Confluence Server and Data Center Path Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-3398-atlassian-confluence-server-and-data-center-path-traversal"},{"cve":"CVE-2019-3396","cvss":9.8,"slug":"cve-2019-3396-atlassian-confluence-server-and-data-center-server-side-template","title":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-3396-atlassian-confluence-server-and-data-center-server-side-template"},{"cve":"CVE-2021-26084","cvss":9.8,"slug":"cve-2021-26084-atlassian-confluence-server-and-data-center-object-graph","title":"Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-26084-atlassian-confluence-server-and-data-center-object-graph"},{"cve":"CVE-2019-11580","cvss":9.8,"slug":"cve-2019-11580-atlassian-crowd-and-crowd-data-center-remote-code-execution","title":"Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-11580-atlassian-crowd-and-crowd-data-center-remote-code-execution"},{"cve":"CVE-2016-6668","cvss":7.5,"slug":"cve-2016-6668-atlassian-hipchat-integration-plugin-secret-key-disclosure","title":"Atlassian HipChat Integration Plugin secret key disclosure","severity":"high","exploited":false,"published_at":"2017-01-23T21:59:02.36+00:00","url":"https://junglewise.ai/threats/cve-2016-6668-atlassian-hipchat-integration-plugin-secret-key-disclosure"},{"cve":"CVE-2016-6283","cvss":6.1,"slug":"cve-2016-6283-atlassian-confluence-persistent-xss-in-attachment-properties","title":"Atlassian Confluence persistent XSS in attachment properties","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.813+00:00","url":"https://junglewise.ai/threats/cve-2016-6283-atlassian-confluence-persistent-xss-in-attachment-properties"}],"vendor":{"hub":true,"name":"Atlassian","slug":"atlassian","homepage":"https://www.atlassian.com/","description":"An Australian software company that develops products for software developers, project managers, and other software development teams.","url":"https://junglewise.ai/threats/vendors/atlassian"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":2}],"most_severe":[{"cve":"CVE-2023-22527","cvss":10,"slug":"cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection","title":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2024-01-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection"},{"cve":"CVE-2023-22518","cvss":10,"slug":"cve-2023-22518-atlassian-confluence-data-center-and-server-improper","title":"Atlassian Confluence Data Center and Server Improper Authorization Vulnerability","severity":"critical","exploited":true,"published_at":"2023-11-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22518-atlassian-confluence-data-center-and-server-improper"},{"cve":"CVE-2023-22515","cvss":10,"slug":"cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control","title":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","severity":"critical","exploited":true,"published_at":"2023-10-05T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control"},{"cve":"CVE-2022-26138","cvss":9.8,"slug":"cve-2022-26138-atlassian-questions-for-confluence-app-hard-coded-credentials","title":"Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability","severity":"critical","exploited":true,"published_at":"2022-07-29T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-26138-atlassian-questions-for-confluence-app-hard-coded-credentials"},{"cve":"CVE-2022-26134","cvss":9.8,"slug":"cve-2022-26134-atlassian-confluence-server-and-data-center-remote-code-execution","title":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-06-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-26134-atlassian-confluence-server-and-data-center-remote-code-execution"},{"cve":"CVE-2019-11581","cvss":9.8,"slug":"cve-2019-11581-atlassian-jira-server-and-data-center-server-side-template","title":"Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-11581-atlassian-jira-server-and-data-center-server-side-template"},{"cve":"CVE-2019-11580","cvss":9.8,"slug":"cve-2019-11580-atlassian-crowd-and-crowd-data-center-remote-code-execution","title":"Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-11580-atlassian-crowd-and-crowd-data-center-remote-code-execution"},{"cve":"CVE-2019-3396","cvss":9.8,"slug":"cve-2019-3396-atlassian-confluence-server-and-data-center-server-side-template","title":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-3396-atlassian-confluence-server-and-data-center-server-side-template"},{"cve":"CVE-2021-26084","cvss":9.8,"slug":"cve-2021-26084-atlassian-confluence-server-and-data-center-object-graph","title":"Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-26084-atlassian-confluence-server-and-data-center-object-graph"},{"cve":"CVE-2022-36804","cvss":8.8,"slug":"cve-2022-36804-atlassian-bitbucket-server-and-data-center-command-injection","title":"Atlassian Bitbucket Server and Data Center Command Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2022-09-30T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-36804-atlassian-bitbucket-server-and-data-center-command-injection"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Atlassian Confluence Data Center","slug":"confluence-data-center","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/confluence-data-center"},{"name":"Atlassian Temporal Server","slug":"server","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/server"},{"name":"Atlassian Confluence Server","slug":"confluence-server","vulnerabilities":10,"url":"https://junglewise.ai/threats/technologies/confluence-server"},{"name":"Atlassian Data Center","slug":"data-center","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/data-center"}]}