DaystoPatch

VendorsEnterprise apps, Dev tools

Atlassian

Atlassian makes Jira, Confluence, Bitbucket and Bamboo, sold as cloud services and as self-managed Data Center products.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
5 Oct 2026
Incidents on record
2

Response to exploited bugs

Not rated. No reviewed zero-days yet.

Fixing privately reported bugs

Not rated. No private reports in the grading window.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
  • Fixing privately reported bugs: not rated. No private reports in the last 36 months.
  • 1 of 1 reviewed exploited bug had a public fix before exploitation was reported. It does not count toward the response grade.
  • NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.

Response to exploited bugs: sub-scores

  • Time to first advisoryNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to first fixNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to fix all versionsNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • OpennessNo machine-readable advisory feed listed. No public alert channel listed.
    25
    2 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedNo private reports in the last 36 months
    NR
    0 cases, not used

Response fingerprint

Compressed time scale

Counts toward the response grade 0

No incidents count toward the grade yet.

Not graded 2: n-days, unreviewed timelines and end-of-life products
  1. 5 Oct 2026Arbitrary File Access Vulnerability impacts Multiple Atlassian Data Center ProductsNot graded: n-day
  2. 12 Aug 2021Jira Server and Data Center limited remote file read via path traversal (JRASERVER-72695)Not graded: n-day
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

2 in 24 months, 0 with known ransomware use, 0% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
5 Oct 2026Arbitrary File Access Vulnerability impacts Multiple Atlassian Data Center ProductsCVE-2026-215899.3same daysame daysame dayFixedNot graded: n-day
12 Aug 2021Jira Server and Data Center limited remote file read via path traversal (JRASERVER-72695)CVE-2021-260865.3same daysame daysame dayFixedNot graded: n-day

Private reports

None in the window

Bugs reported privately to Atlassian by ZDI or Project Zero.

No privately reported cases from ZDI or Project Zero in the window.

Advisories changed after publication

2 shown, 2 without a revision note

  1. JRASERVER-72695

    Changed without a revision note

    Public Security Vulnerability

    Workaround text changed.

    • Workaround
    Workaround
    BeforeUntil the upgrade you may use the following workaround to protect the files: https://confluence.atlassian.com/jirakb/workaround-for-cve-2019-15004-979416164.html Attachments Issue Links relates to CONFSERVER-60469 Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448 Pu
    AfterUntil the upgrade you may use the following workaround to protect the files: https://confluence.atlassian.com/jirakb/workaround-for-cve-2019-15004-979416164.html Note: Workaround 1 in the above KB article is not valid for this purpose. Workaround 2 (proxy/load balancer configuration) is valid. Attac
    Earlier version captured 9 Dec 2021, 11:37 UTC: archived copyLater version captured 23 May 2022, 23:11 UTC: archived copyRecovered from archived copiesSnapshots c55070182a… and e0e7220c48…Incident page

  2. JRASERVER-72695

    Changed without a revision note

    Public Security Vulnerability

    Workaround text added.

    • Workaround
    Workaround
    Beforenot present
    AfterUntil the upgrade you may use the following workaround to protect the files: https://confluence.atlassian.com/jirakb/workaround-for-cve-2019-15004-979416164.html Attachments Issue Links relates to CONFSERVER-60469 Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448 Pu
    Earlier version captured 28 Oct 2021, 01:07 UTC: archived copyLater version captured 30 Nov 2021, 11:28 UTC: archived copyRecovered from archived copiesSnapshots a823ef55d9… and 9c416a943e…Incident page

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Atlassian's own alerts

What we watch

  • Advisory pageAtlassian Security Advisories & Bulletins

See sources and health for when each was last read.