Collaboration Platforms Under Measurement: 185,584 Confluence and 91,979 Jira Instances

Collaboration platforms rank high on attacker lists because they authenticate employees, store documents and sit inside the network. The exposure figures show how many of them are visible from outside.

The measurements

ZoomEye queries executed on 2026-10-08 between 22:32 and 22:34 UTC, sub_type all, global index:
| Query | Matching assets |
| --- | ---: |
| app="Confluence" | 185,584 |
| app="Atlassian Jira" | 91,979 |
| app="Jira" | 19,892 |
| app="MediaWiki" | 2 |
Confluence leads at 185,584 assets. The two Jira rows differ by a factor of about four, which is a useful illustration of how much a query string changes the population: the vendor-qualified name and the short product name are not interchangeable.
MediaWiki shows a count of 2, a reminder that public wiki deployments are often internal or that the fingerprint rarely matches. Reporting this period described an exploited flaw in a MediaWiki extension with a full CVSS score, which shows that a low exposure count says nothing about whether a platform matters to its owners.

Why collaboration platforms are targeted

These systems hold the documents that describe how an organisation works, and they usually federate with the identity provider. Successfully attacking one yields both content and an authenticated position, which is why exploited flaws in this category tend to appear in intrusion reports rather than in isolated incidents.
The patching challenge is specific to this class. Customisation is normal: plugins, macros and third-party integrations accumulate over years. A platform that reports a current version can still expose a vulnerable extension, and vulnerability scanners that read only the core version will not see it.

What the counts suggest

Use the fingerprinted population to understand how discoverable these platforms are, then focus on your own deployment. Confirm which collaboration instances are internet-facing and whether that reachability is required for the user population. Many organisations publish these platforms by default and then add single sign-on as the only control.
Check the extension and integration inventory alongside the core version. Where a plugin has produced an exploited flaw, an update to the plugin is the fix, and it will not arrive with the monthly core patch.

Method notes and limits

The counts are fingerprint matches without version detail. The gap between the two Jira rows demonstrates that these figures depend heavily on query construction, so they should be treated as estimates of discoverability rather than as deployment censuses. All queries used the same scope setting and ran in the same session.

References

ZoomEye, cyberspace search: https://www.zoomeye.ai
CSDN weekly security situation report on collaboration platform exploitation: https://blog.csdn.net/weixin_41905135/article/details/166983831