atlassian has 17 CVEs on record between 2025 and 2026. 4 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 4.3 (medium), with 1 rated critical. 6% have been exploited in the wild, in line with the corpus average. The most common weakness class is CWE-285 (12). Most affected products: jira_align (11), Confluence Data Center (2), Bamboo Data Center (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 6% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —(1)
- Last 90 days
- 4 prev 0
Weakness classes
Products
- jira_align 11
- Confluence Data Center 2
- Bamboo Data Center 1
- Jira Service Management Data Center 1
- bamboo 1
- confluence_data_center 1
Worst active — by depth score
CVE-2026-21589Critical· 9.3This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center96CVE-2026-21570High· 8.8This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a C…49CVE-2025-22166High· 7.5This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unava…41CVE-2026-21588High· 7.1This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, wit…39CVE-2026-21587High· 7.1This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center39
atlassian vulnerabilities
CVEs affecting atlassian, newest first. Open any entry for full detail, references, and exploit status.
17 CVEsRSS
CVE-2026-21589Critical· 9.3CISA KEVPoCThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerabili…
CVE-2026-21588High· 7.1This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, wit…
This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, wit…
CVE-2026-21587High· 7.1This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center
This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to…
CVE-2026-21586High· 7.1This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorizatio…
This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorizatio…
CVE-2026-21570High· 8.8This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a C…
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a C…
CVE-2025-22178Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page.
CVE-2025-22177Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews.
CVE-2025-22176Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items.
CVE-2025-22175Medium· 5.4Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's …
CVE-2025-22174Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the re…
CVE-2025-22173Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without th…
CVE-2025-22172Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the r…
CVE-2025-22171Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users.
CVE-2025-22170Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the a…
CVE-2025-22169Medium· 5.4Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without…
CVE-2025-22168Medium· 4.3Jira Align is vulnerable to an authorization issue
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's pr…
CVE-2025-22166High· 7.5This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unava…
This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unava…