{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:42:00.965Z",
  "tag": {
    "id": "atlassian",
    "label": "Atlassian",
    "isStack": false,
    "url": "https://pwn.watch/t/atlassian",
    "feed": "https://pwn.watch/t/atlassian/feed.xml"
  },
  "counts": {
    "incidents": 6,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 6
  },
  "incidents": [
    {
      "slug": "atlassian-multiple-products-cve-2026-21589",
      "title": "Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
      "url": "https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589",
      "json": "https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Atlassian Multiple Products",
      "tags": [
        "atlassian",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-21589"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-10-15",
      "closedAt": null,
      "updatedAt": "2026-10-15",
      "summary": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15.",
      "xPost": null
    },
    {
      "slug": "atlassian-jira-server-and-data-center-cve-2021-26086",
      "title": "Atlassian Jira Server and Data Center Path Traversal",
      "url": "https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086",
      "json": "https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Atlassian Jira Server and Data Center",
      "tags": [
        "java",
        "atlassian",
        "jira",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2021-26086"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-12",
      "closedAt": "2024-11-12",
      "updatedAt": "2024-11-12",
      "summary": "Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint. Added to the CISA KEV catalog on 2024-11-12. CVE-2021-26086 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "atlassian-confluence-data-center-and-server-cve-2023-22527",
      "title": "Atlassian Confluence Data Center and Server Template Injection",
      "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527",
      "json": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Atlassian Confluence Data Center and Server",
      "tags": [
        "java",
        "atlassian",
        "confluence",
        "cisa-kev",
        "ransomware",
        "rce"
      ],
      "cveIds": [
        "CVE-2023-22527"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-16",
      "closedAt": "2024-01-24",
      "updatedAt": "2024-01-24",
      "summary": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Added to the CISA KEV catalog on 2024-01-24. CISA lists known use in ransomware campaigns. CVE-2023-22527 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "title": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion",
      "json": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Cloudflare internal Atlassian environment",
      "tags": [
        "cloudflare",
        "okta",
        "atlassian",
        "confluence",
        "secrets"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-11-14",
      "closedAt": "2024-02-01",
      "updatedAt": "2024-02-01",
      "summary": "A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.",
      "xPost": null
    },
    {
      "slug": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "title": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518",
      "json": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Atlassian Confluence Data Center and Server",
      "tags": [
        "java",
        "atlassian",
        "confluence",
        "auth-bypass",
        "ransomware",
        "cerber",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-22518"
      ],
      "affectedVersions": [
        "All versions of Confluence Data Center and Server before the fixed releases (NVD)"
      ],
      "fixedVersions": [
        "7.19.16",
        "8.3.4",
        "8.4.4",
        "8.5.3",
        "8.6.1"
      ],
      "startedAt": "2023-10-31",
      "closedAt": "2023-11-07",
      "updatedAt": "2023-11-07",
      "summary": "An improper authorization bug let unauthenticated attackers reset Confluence Data Center and Server and create a new admin. Within days of disclosure it was exploited to deploy Cerber ransomware. Atlassian Cloud was not affected.",
      "xPost": null
    },
    {
      "slug": "atlassian-confluence-admin-creation-cve-2023-22515",
      "title": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515",
      "json": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Atlassian Confluence Data Center and Server",
      "tags": [
        "java",
        "atlassian",
        "confluence",
        "zero-day",
        "auth-bypass",
        "china",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-22515"
      ],
      "affectedVersions": [
        "8.0.0 to 8.5.1 (Atlassian advisory)"
      ],
      "fixedVersions": [
        "8.3.3",
        "8.4.3",
        "8.5.2 (LTS)"
      ],
      "startedAt": "2023-10-04",
      "closedAt": "2023-10-16",
      "updatedAt": "2023-10-16",
      "summary": "A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "atlassian-multiple-products-cve-2026-21589",
      "incidentTitle": "Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
      "severity": "high",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-15",
      "title": "CISA added CVE-2026-21589 to the KEV catalog (due 2026-10-18).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589"
    },
    {
      "incident": "atlassian-jira-server-and-data-center-cve-2021-26086",
      "incidentTitle": "Atlassian Jira Server and Data Center Path Traversal",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-12",
      "title": "CISA added CVE-2021-26086 to the KEV catalog (federal deadline 2024-12-03)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-02-01",
      "title": "Cloudflare publishes its full write-up",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527",
      "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-24",
      "title": "CISA added CVE-2023-22527 to the KEV catalog (federal deadline 2024-02-14)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527"
    },
    {
      "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527",
      "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-16",
      "title": "CVE-2023-22527 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-22527",
      "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-23",
      "title": "Cloudflare detects the attacker on its self-hosted Atlassian server",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-14",
      "title": "Attacker begins reconnaissance with credentials from the Okta compromise",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-07",
      "title": "CISA adds CVE-2023-22518 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518"
    },
    {
      "incident": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-06",
      "title": "Atlassian raises the CVSS score to 10 after active exploitation and Cerber ransomware deployments",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518"
    },
    {
      "incident": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-31",
      "title": "Atlassian discloses CVE-2023-22518 and ships fixes",
      "body": null,
      "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html",
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-16",
      "title": "CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-05",
      "title": "CISA adds CVE-2023-22515 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "Atlassian discloses the zero-day after customer reports and ships fixes",
      "body": null,
      "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    }
  ]
}