MEIFP – Most Exploited Internet-Facing Products

Atlassian

Products: Bamboo Data Center · Bitbucket Data Center · Confluence Data Center · Confluence Server · Crowd Data Center · Crucible Data Center · Fisheye Data Center · Jira Service Management Data Center · Jira Software Data Center

112.3

Score

CVEs

Active

PoC

KEV

#24

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2026-21589	2026-10-05	9.3v4.0	ACTIVE		Low	None	no	31.2	Bamboo Data CenterBitbucket Data CenterConfluence Data CenterCrowd Data CenterCrucible Data CenterFisheye Data CenterJira Service Management Data CenterJira Software Data Center	This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files
CVE-2024-21683	2024-05-21	7.2v3.1	POC	—	Low	Low	no	0.0	Confluence Data Center	This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidential
CVE-2023-22527	2024-01-16	10.0v3.0	ACTIVE		Low	None	YES	40.6	Confluence Data CenterConfluence Server	A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server ar
CVE-2023-22518	2023-10-31	10.0v3.0	ACTIVE		Low	None	YES	40.6	Confluence Data CenterConfluence Server	All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3