Atlassian's Two-Year Treadmill: Every Jira and Confluence Data Center Version Dies Two Years After Its Own Release — and the Server Ghost Fleet Keeps Getting Ransomed

Published: August 11, 2026  ·  EOL Watch — lifecycle coverage  ·  Dates verified against Atlassian's end-of-life policy, Atlassian's Server end-of-support announcement, the CISA KEV catalog (2026-08-10 release), and our tracked lifecycle data — methodology

There is no evergreen Atlassian self-hosted version. Atlassian's end-of-life policy is one sentence long where it matters: Atlassian "supports releases for two years after the initial feature or Long-Term Support (LTS) release." Every Jira Software Data Center and Confluence Data Center version starts its own two-year clock the day it ships, and when the clock runs out — security fixes included — that version is done, no matter how many versions came after it or how "recent" it feels.

The clock runs faster than most upgrade cadences. As of today, the oldest supported Jira Data Center release is Jira 10.0, released August 22, 2024 — and it reaches end of life on August 22, 2026, eleven days from now. On the Confluence side the line has already moved: Confluence 9.0, released July 30, 2024, reached end of life on July 30, 2026. If you are on it, you are not "one major version behind" — you are unsupported, and the next fix Atlassian ships will not apply to you.

And behind the Data Center treadmill sits a darker lifecycle story. Atlassian Server — the perpetual-license product an unknown but large number of organizations never migrated off — lost all support and bug fixes on February 15, 2024. That fleet has now run two and a half years without a single patch, while Confluence Server versions rank among the most ransomware-targeted software in CISA's entire Known Exploited Vulnerabilities catalog: three separate Confluence CVEs with confirmed ransomware campaign use, each permanently unpatchable on the end-of-life versions attackers find them on. Our Exploited & Unpatchable feed documents all three, with exact affected and fixed versions.

The policy: two years, from that version's release — not from the product's

Atlassian's support model is unusually easy to state and unusually easy to misread. The policy's own worked example: "We support Jira Software Data Center 10.4.0 for two years, until January 22, 2027, because we shipped it on January 22, 2025." That matches our tracked data exactly — and it means the support window is a property of the version you installed, not of the product line. Jira Data Center is fully supported as a product; the Jira 10.1 instance you deployed in October 2024 still dies this October.

Two consequences follow. First, the practical window is shorter than two years: nobody installs a release on its ship date, so an organization that adopts a version six months after release has eighteen months before it must move again. Second, "we upgraded recently" and "we are supported" are different claims — a team that jumped to Jira 10.4 in early 2025 did the right thing and still faces a January 22, 2027 deadline.

The pressure valve is the Long-Term Support (Enterprise) release. Roughly once a year, Atlassian designates one feature release as LTS and keeps shipping bug-fix updates on that line for its full two-year window — per our data, the recent LTS lines are Jira 9.12, 10.3 and 11.3, and Confluence 8.5, 9.2 and 10.2, and the long-running fix streams are real (Jira 10.3 is at 10.3.24; Confluence 9.2 at 9.2.23). An LTS release gets the same two years as any other release — what it buys you is a stable platform to sit on between upgrades, not extra time. Organizations that hop LTS-to-LTS upgrade about once a year and spend most of that time on a maintained line; organizations that adopt non-LTS feature releases carry the same two-year deadline with fewer backported fixes.

Jira Software Data Center: every version's dates

All currently supported Jira Software Data Center releases plus the two most recently expired, from our tracked Jira Software data. Every version links to its lifecycle page with live status and risk score.

Confluence Data Center: every version's dates

All currently supported Confluence Data Center releases plus the three most recently expired, from our tracked Confluence data. Note the top of the dead list: 9.0 is not old — it expired twelve days ago.

Dates from our tracked dataset (verification pass 2026-08-11), cross-checked against Atlassian's end-of-life policy. Atlassian occasionally extends an LTS line slightly past two calendar years (Confluence 8.5 ran to December 15, 2025); we list the tracked dates. Badges and dates in these tables are re-verified against the data layer at every site build.

The Server ghost fleet: zero patches since February 15, 2024

Data Center is the treadmill; Server is the graveyard. Atlassian stopped selling new Server licenses on February 2, 2021, and on February 15, 2024 the line in its migration announcement came due: "support and bug fixes will no longer be available for your server products." Not "reduced support" — none, at any severity, for any Server product, forever.

That would be a routine end-of-life story if Server installs had actually disappeared. The exploitation record says they did not. Confluence Server's flaws keep being exploited years after disclosure — which only happens when unpatched instances remain reachable in numbers worth an attacker's time. Three Confluence entries in CISA's Known Exploited Vulnerabilities catalog — re-confirmed against the live catalog (2026-08-10 release) before publishing — carry the KEV field that matters most: known ransomware campaign use. And each one affects version lines that were already end of life when the fixes shipped, meaning the versions the ghost fleet actually runs never got, and never will get, a patch:

Read that pattern once more, because it is the whole argument: three times in three consecutive years, a critical unauthenticated Confluence flaw was disclosed, mass-exploited, adopted by ransomware operators, and fixed only on the version lines still inside their two-year windows. Every line outside the window got silence. CVE-2023-22518 is the starkest case — an attacker needs no credentials to wipe a Confluence instance and create their own administrator account, ransomware groups picked it up within days of disclosure in November 2023, and on the 5.x, 6.x and non-LTS 7.x lines there is no patch to apply and never will be.

All three entries — with CVSS vectors, affected-version statements from Atlassian's own advisories, fixed-version lists, and the reasoning for why each qualifies as permanently unpatchable — are maintained in our Exploited & Unpatchable feed, the curated intersection of CISA's KEV catalog with end-of-life version data. It is also available as a free JSON feed. Confluence is one of the feed's most represented products — a distinction no vendor wants.

The operational takeaway for anyone who inherited an Atlassian estate: finding a Server instance is finding an incident waiting to be scheduled. The versions in the table above are exactly the versions a forgotten 2019-era Confluence Server runs. Scan for it the way the attackers do — it answers on the network, and every one of these CVEs has public, weaponized exploit code.

The decision fork: the treadmill, or the Cloud

Atlassian's self-hosted lifecycle now offers exactly two honest paths, and pretending there is a third — staying put — is how organizations end up in the table above.

Path 1 — run the Data Center treadmill deliberately. Accept the two-year cadence and plan around the LTS (Enterprise) releases: land on the current LTS — Jira 11.3 and Confluence 10.2, both supported to early December 2027 — and schedule the next hop before each window closes. This is a real, supported strategy; it simply has a recurring cost that perpetual-license Server never had, roughly one upgrade project per product per year to eighteen months. One caveat belongs in the plan: per our Atlassian Data Center tracker, Atlassian has closed Data Center to new customers (March 30, 2026), ends existing-customer renewals March 30, 2028, and has announced full Data Center end of life on March 28, 2029 — so the treadmill itself now has a published finish line, and a Data Center commitment made today is a bridge measured in single-digit years.

Path 2 — move to Atlassian Cloud. This is the destination Atlassian's own lifecycle decisions point toward, and it removes the version clock entirely — there is no version to be on. The trade-offs are the standard self-hosted-to-SaaS ones (data residency, compliance regimes, plugin/app parity, and pricing that scales differently than a perpetual license did), and they are real evaluation work rather than a footnote. What the Cloud path is not is optional to evaluate: with Server dead since 2024 and Data Center's own end of life announced, every Atlassian self-hosted roadmap now needs a written answer to "Cloud when, or off Atlassian to what?"

What is not a path is the status quo. The Server exploitation record above is what "we'll decide later" looks like three years on — and the Data Center two-year clock means "later" arrives on a schedule you can read off the tables in this article.

We track every Jira Software release, every Confluence release, the Atlassian Data Center platform dates, and 480+ other products against vendor-verified dates — check any version in seconds, or see what else hits end of life this quarter.

Frequently Asked Questions

Related

• All Jira Software versions with live status · All Confluence versions · Atlassian Data Center platform dates
• Exploited & Unpatchable — every KEV-listed vulnerability that EOL versions will never get a fix for, including all three Confluence entries
• What Is LTS? Long-Term Support Explained — how two-year windows and LTS designations actually work
• The 2026 EOL Calendar — everything else with a 2026 date, including Jira 10.x's rolling expiries