CISA KEV by vendor
Atlassian vulnerabilities in the CISA KEV catalogue
14 Atlassian entries in CISA's Known Exploited Vulnerabilities catalogue, 8 of them (57 percent) known to have been used in ransomware campaigns. First added 3 November 2021, latest 15 October 2026.
Data status: a source is stale
Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually
14entries, 0.8% of the catalogue
8known ransomware use
0added in the last 7 days
0federal due dates in the next 14 days
Products
| Product, as CISA names it | Entries |
|---|---|
| Confluence Data Center and Server | 3 |
| Jira Server and Data Center | 2 |
| Confluence Server and Data Center | 2 |
| Multiple Products | 1 |
| Bitbucket Server and Data Center | 1 |
| Confluence | 1 |
| Confluence Server/Data Center | 1 |
| Confluence Server | 1 |
| Confluence Server and Data Server | 1 |
| Crowd and Crowd Data Center | 1 |
Latest additions
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-21589 | Multiple Products | 2026-10-15 | 2026-10-18 passed | Unknown | 9.3 Critical | 99.6% | Not auto, total | 3 days + triage |
| CVE-2021-26086 | Jira Server and Data Center | 2024-11-12 | 2024-12-03 | Unknown | 5.3 Medium | 99.9% | Auto, partial | 3 days |
| CVE-2023-22527 | Confluence Data Center and Server | 2024-01-24 | 2024-02-14 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2023-22518 | Confluence Data Center and Server | 2023-11-07 | 2023-11-28 | Known | 9.8 Critical | 99.9% | Auto, partial | 3 days |
| CVE-2023-22515 | Confluence Data Center and Server | 2023-10-05 | 2023-10-13 | Known | 9.8 Critical | 99.2% | Auto, total | 3 days + triage |
| CVE-2022-36804 | Bitbucket Server and Data Center | 2022-09-30 | 2022-10-21 | Unknown | 8.8 High | 99.0% | Not auto, total | 3 days + triage |
| CVE-2022-26138 | Confluence | 2022-07-29 | 2022-08-19 | Unknown | 9.8 Critical | 98.2% | Auto, total | 3 days + triage |
| CVE-2022-26134 | Confluence Server/Data Center | 2022-06-02 | 2022-06-06 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2021-26085 | Confluence Server | 2022-03-28 | 2022-04-18 | Known | 5.3 Medium | 99.9% | Auto, partial | 3 days |
| CVE-2019-11581 | Jira Server and Data Center | 2022-03-07 | 2022-09-07 | Unknown | 9.8 Critical | 84.6% | Auto, total | 3 days + triage |
All 14 entries
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-21589 | Multiple Products | 2026-10-15 | 2026-10-18 passed | Unknown | 9.3 Critical | 99.6% | Not auto, total | 3 days + triage |
| CVE-2021-26086 | Jira Server and Data Center | 2024-11-12 | 2024-12-03 | Unknown | 5.3 Medium | 99.9% | Auto, partial | 3 days |
| CVE-2023-22527 | Confluence Data Center and Server | 2024-01-24 | 2024-02-14 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2023-22518 | Confluence Data Center and Server | 2023-11-07 | 2023-11-28 | Known | 9.8 Critical | 99.9% | Auto, partial | 3 days |
| CVE-2023-22515 | Confluence Data Center and Server | 2023-10-05 | 2023-10-13 | Known | 9.8 Critical | 99.2% | Auto, total | 3 days + triage |
| CVE-2022-36804 | Bitbucket Server and Data Center | 2022-09-30 | 2022-10-21 | Unknown | 8.8 High | 99.0% | Not auto, total | 3 days + triage |
| CVE-2022-26138 | Confluence | 2022-07-29 | 2022-08-19 | Unknown | 9.8 Critical | 98.2% | Auto, total | 3 days + triage |
| CVE-2022-26134 | Confluence Server/Data Center | 2022-06-02 | 2022-06-06 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2021-26085 | Confluence Server | 2022-03-28 | 2022-04-18 | Known | 5.3 Medium | 99.9% | Auto, partial | 3 days |
| CVE-2019-11581 | Jira Server and Data Center | 2022-03-07 | 2022-09-07 | Unknown | 9.8 Critical | 84.6% | Auto, total | 3 days + triage |
| CVE-2021-26084 | Confluence Server and Data Center | 2021-11-03 | 2021-11-17 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2019-3398 | Confluence Server and Data Center | 2021-11-03 | 2022-05-03 | Unknown | 8.8 High | 97.0% | Not auto, total | 3 days + triage |
| CVE-2019-3396 | Confluence Server and Data Server | 2021-11-03 | 2022-05-03 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2019-11580 | Crowd and Crowd Data Center | 2021-11-03 | 2022-05-03 | Known | 9.8 Critical | 95.3% | Auto, total | 3 days + triage |
Due dates bind US federal civilian executive branch agencies only (BOD 26-04). Filter Atlassian in the tracker by date, score or status.
Source: CISA Known Exploited Vulnerabilities Catalog; NVD, FIRST EPSS and CISA SSVC for the scores. This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs.