CVE-2026-21587: Atlassian Jira Service Management Data Center vulnerability
This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Jira Service Management Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Service Management Data Center 11.3: Upgrade to a release greater than or equal to 11.3.11 See the release notes (https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html). You can download the latest version of Jira Service Management Data Center from the download center (https://www.atlassian.com/software/jira/service-management/download-archives). This vulnerability was reported via our Penetration Testing program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jira Service Management Data Centerto a version that resolves this vulnerability.Fixed in 11.3.11
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to exploit it. The issue affects Jira Service Management Data Center instances running the affected 11.3 release line before version 11.3.11.
What is the minimum fixed version for the 11.3 release line?
Upgrade Jira Service Management Data Center 11.3 to version 11.3.11 or later. Atlassian also recommends upgrading to the latest available version.
What is the potential impact if exploited?
An authenticated attacker may gain unintended access to resources or functionality. This could expose sensitive information and may potentially enable arbitrary code execution.