Jira Data Center vulnerabilities

8 known vulnerabilities in Jira Data Center from Atlassian. 7 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Atlassian Multiple Products Files or Directories Accessible to External Parties Exploited

  CVE-2026-21589Oct 5, 2026AtlassianEPSS 99.7%

  This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenti

• 8.8 High severity

  Jira Core Data Center: Improper Access Control

  CVE-2025-22157May 20, 2025Atlassian

  This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc

• 8.8 High severity

  Confluence Data Center: Improper Control of Generation of Code

  CVE-2024-21683May 21, 2024AtlassianEPSS 88.3%

  This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary cod

• 7.2 High severity

  Jira Server: Improper Control of Generation of Code

  CVE-2022-36799Aug 1, 2022AtlassianEPSS 46.7%

  This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions

• 8.8 High severity

  Bamboo Server: Origin Validation Error

  CVE-2022-26137Jul 20, 2022AtlassianEPSS 2.41%

  A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue ass

• 9.8 Critical severity

  Bamboo Server: Improper Authentication

  CVE-2022-26136Jul 20, 2022AtlassianEPSS 5.66%

  A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability ca

• 9.8 Critical severity

  Jira Core Server: Improper Authentication

  CVE-2022-0540Apr 20, 2022AtlassianEPSS 88.1%

  A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6,

• 5.3 Medium severity

  Atlassian Jira Server and Data Center Path Traversal Exploited

  CVE-2021-26086Aug 16, 2021AtlassianEPSS 100%

  Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, a