SecAlerts
A

Atlassian

Security Risk Profile

52
/100
medium

Security Risk Score

Comprehensive risk assessment based on 807 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from April 10, 2002 to present

807
Total CVEs
198
Critical+High
21
Exploited
155
Unpatched

Threat Assessment

Avg CVSS
6.6
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
155
Critical/High
Risk Level
52/100
medium
⚠️ 21 Active Exploits⚡ 18 Zero-Days🆕 1Fresh (<7d)📈 9 in Last 30 Days

Severity Distribution

Critical
69
High
129
Medium
301
Low
3

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
4

Age Distribution

Common Weaknesses (CWE)

1
XSS
115
2
CSRF
38
3
Path Traversal
27
4
Code Injection
24
5
SSRF
21

Most Affected Products

1. Atlassian Jira512
2. Atlassian Bamboo395
3. Atlassian Jira Server288
4. Atlassian Confluence Server205
5. Atlassian Confluence Data Center193

Recent Vulnerabilities

See more →
https://reddit.com/r/Infosec/comments/1wztdab/interesting_day_for_ransomware_yesterday/
unknown

Interesting day for Ransomware yesterday...

Oct 7, 2026🔧 No Patch
https://reddit.com/r/cybersecurity/comments/1wz839l/you_wont_hear_about_these_even_in_myths_atlassian/
unknown

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - watchTowr Labs

Oct 6, 2026🔧 No Patch
https://reddit.com/r/netsec/comments/1wz82op/you_wont_hear_about_these_even_in_myths_atlassian/
unknown

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - watchTowr Labs

Oct 6, 2026🔧 No Patch
CVE-2026-21589
CVSS 9.3critical

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Oct 5, 2026⚠ Exploited🔧 No Patch
CVE-2026-77246
CVSS 8.6high

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

Sep 22, 2026
CVE-2026-77248
CVSS 8.6high

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

Sep 22, 2026
CVE-2026-77255
CVSS 8.6high

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

Sep 22, 2026
CVE-2026-77270
CVSS 6.5medium

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

Sep 22, 2026
CVE-2026-21586
CVSS 7.1high
Sep 15, 2026🔧 No Patch
CVE-2026-21587
CVSS 7.1high
Sep 15, 2026🔧 No Patch

Monitor Atlassian in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.