Skip to main content

Jira Service Management Data Center CVE-2026-21587

| EUVDEUVD-2026-78936 HIGH
Improper Authorization (CWE-285)
2026-09-15 atlassian GHSA-gp6h-7p69-238v
Authentication Bypass RCE Atlassian Jira Service Management Data Center
7.1
CVSS 4.0 · Vendor: atlassian
Share

Severity by source

Vendor (atlassian) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (atlassian) · only source for this CVE.

CVSS VectorVendor: atlassian

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 17:36 vuln.today
CVE Published
Sep 15, 2026 - 17:00 cve.org
HIGH 7.1

DescriptionCVE.org

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center.

This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code.

Atlassian recommends that Jira Service Management Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

  • Jira Service Management Data Center 11.3: Upgrade to a release greater than or equal to 11.3.11

See the release notes (https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html). You can download the latest version of Jira Service Management Data Center from the download center (https://www.atlassian.com/software/jira/service-management/download-archives).

This vulnerability was reported via our Penetration Testing program.

AnalysisAI

Improper authorization in Atlassian Jira Service Management Data Center 11.3.0 through 11.3.10 lets an authenticated, low-privileged attacker reach functionality and data they should not be able to access, with the vendor scoring it 7.1 in CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VI:H). Atlassian states the flaw was discovered through its own penetration-testing program and that the impact could extend from exposure of sensitive resources to arbitrary code execution, though the published CVSS 4.0 vector only credits a high integrity impact and rates confidentiality and availability as none. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-55166 CRITICAL POC
9.9

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-21587 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy