# Atlassian vulnerabilities & exploitation

**CISA KEV** · **Ransomware**

> As of 2026-10-10, Threadlinqs tracks 5 Atlassian CVEs, 4 in the CISA Known Exploited Vulnerabilities catalog, 3 used in ransomware campaigns, linked to 13 tracked threat campaigns and 5 named threat actors.

**Data as of:** 2026-10-10

## Exploitation timeline

Threadlinqs has recorded 5 Atlassian CVEs published between 2019-06-15 and 2026-10-15. The busiest month was 2026-10 (1 new CVE). 4 of them (80%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked Atlassian CVEs.

- [CVE-2022-26134](https://intel.threadlinqs.com/cve/CVE-2022-26134) — CRITICAL 9.8 · KEV · Ransomware · EPSS 100% · 2022-06-03
- [CVE-2021-26086](https://intel.threadlinqs.com/cve/CVE-2021-26086) — MEDIUM 5.3 · KEV · EPSS 100% · 2021-08-16
- [CVE-2023-22515](https://intel.threadlinqs.com/cve/CVE-2023-22515) — CRITICAL 10 · KEV · Ransomware · EPSS 99.2% · 2023-10-04
- [CVE-2019-11580](https://intel.threadlinqs.com/cve/CVE-2019-11580) — CRITICAL 9.8 · KEV · Ransomware · EPSS 95.4% · 2019-06-03
- [CVE-2026-21589](https://intel.threadlinqs.com/cve/CVE-2026-21589) — CRITICAL 9.3 · EPSS 0.7% · 2026-10-05

## Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 12 distinct Atlassian products are affected. The most frequently affected:

- Confluence Data Center — 3 CVEs
- Confluence Server — 2 CVEs
- Bamboo Data Center — 1 CVE
- Bitbucket Data Center — 1 CVE
- Crowd — 1 CVE
- Crowd Data Center — 1 CVE
- Crucible Data Center — 1 CVE
- Fisheye Data Center — 1 CVE
- Jira Data Center — 1 CVE
- Jira Server — 1 CVE
- Jira Service Management Data Center — 1 CVE
- Jira Software Data Center — 1 CVE

## Threat activity

13 tracked threat campaigns reference Atlassian products or exploit Atlassian CVEs:

- [Evooo1Bot: Multi-Functional Mirai-Based Linux Botnet Exploiting 18 Known CVEs in Internet-Facing Devices](https://intel.threadlinqs.com/threat/TL-2026-3062) — HIGH — 2026-10-09
- [Atlassian Data Center critical unauthenticated arbitrary file access vulnerability (CVE-2026-21589) across Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye](https://intel.threadlinqs.com/threat/TL-2026-2966) — CRITICAL — 2026-10-06
- [RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt Injection in Atlassian Rovo Exposes Confluence, Jira, SharePoint, and Bitbucket Data](https://intel.threadlinqs.com/threat/TL-2026-1939) — CRITICAL — 2026-08-08
- [RovoBlast: One-Click Parameter-to-Prompt Injection in Atlassian Rovo AI Exposes Confluence, Jira, and SharePoint Data](https://intel.threadlinqs.com/threat/TL-2026-1942) — CRITICAL — 2026-08-08
- [CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted Campaigns](https://intel.threadlinqs.com/threat/TL-2026-1885) — HIGH — 2026-08-05
- [Alleged Żabka Polska Breach: 541K Jira Issues, 230K IT Tickets, 89 GitLab Repos, and Cloudflare/MongoDB/Broker Credentials Offered for €5,000](https://intel.threadlinqs.com/threat/TL-2026-1834) — HIGH — 2026-08-03
- [Klue Supply Chain Breach: OAuth Token Harvesting & Salesforce CRM Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-0976) — CRITICAL — 2026-06-28
- [Claude Code MCP Traffic Hijack via Malicious npm postinstall — ~/.claude.json Tampering Proxies MCP Endpoints to Steal Persistent OAuth Bearer Tokens (Mitiga Labs PoC)](https://intel.threadlinqs.com/threat/TL-2026-0712) — HIGH — 2026-06-08
- [Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and Unpatched Confluence — SSH Foothold to NTLM Relay (CVE-2025-33073, CVE-2025-53521)](https://intel.threadlinqs.com/threat/TL-2026-0596) — HIGH — 2026-05-26
- [F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence RCE → CVE-2025-33073 Kerberos Relay to Active Directory (Microsoft Defender Research)](https://intel.threadlinqs.com/threat/TL-2026-0572) — HIGH — 2026-05-23
- [APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting](https://intel.threadlinqs.com/threat/TL-2026-0339) — CRITICAL — 2026-04-09
- [Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution](https://intel.threadlinqs.com/threat/TL-2026-0139) — CRITICAL — 2026-02-24
- [TGR-STA-1030 / UNC6619 Shadow Campaigns — China-Nexus APT Breaches 70+ Government Organizations Across 37 Countries, Recons 155 Nations, Novel ShadowGuard eBPF Rootkit, Diaoyu Loader, Event-Driven Geopolitical Targeting](https://intel.threadlinqs.com/threat/TL-2026-0109) — CRITICAL — 2026-02-06

## Threat actors targeting Atlassian

Named threat actors attributed to campaigns that involve Atlassian products or CVEs, with the number of linked campaigns:

- [APT35](https://intel.threadlinqs.com/actor/APT35) — 1 campaign
- [APT42](https://intel.threadlinqs.com/actor/APT42) — 1 campaign
- [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 1 campaign
- [Icarus](https://intel.threadlinqs.com/actor/Icarus) — 1 campaign
- [UNC5174](https://intel.threadlinqs.com/actor/UNC5174) — 1 campaign

## How to prioritise Atlassian patching

This order follows the data Threadlinqs holds for Atlassian, not a generic severity checklist:

- 4 of 5 Atlassian CVEs (80%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2022-26134](https://intel.threadlinqs.com/cve/CVE-2022-26134), [CVE-2021-26086](https://intel.threadlinqs.com/cve/CVE-2021-26086), [CVE-2023-22515](https://intel.threadlinqs.com/cve/CVE-2023-22515).
- 3 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- Outside KEV, the highest EPSS scores are [CVE-2026-21589](https://intel.threadlinqs.com/cve/CVE-2026-21589) (0.7%).
- 4 CVEs score Critical and 0 High on CVSS v3 (maximum 10, average 8.8); sequence these after KEV and high-EPSS items.
- 5 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/atlassian
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp