CVE-2026-21587
Received Received - Intake

Improper Authorization in Jira Service Management Data Center

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Atlassian

Description
This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Jira Service Management Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Jira Service Management Data Center 11.3: Upgrade to a release greater than or equal to 11.3.11 See the release notes (https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html). You can download the latest version of Jira Service Management Data Center from the download center (https://www.atlassian.com/software/jira/service-management/download-archives). This vulnerability was reported via our Penetration Testing program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-21587
EUVD
EUVD-2026-78936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
atlassian jira_service_management_data_center From 11.3.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Improper Authorization vulnerability in Jira Service Management Data Center version 11.3.0. It allows authenticated attackers to gain unintended access, potentially exposing resources or functionality. This could lead to sensitive information disclosure or arbitrary code execution.

Impact Analysis

An attacker could exploit this to access unauthorized resources or execute arbitrary code. This may result in data breaches, system compromise, or loss of sensitive information if the system is not patched.

Mitigation Strategies

Upgrade Jira Service Management Data Center to version 11.3.11 or later. If unable to upgrade, apply the specified fixed versions immediately to prevent unauthorized access and potential code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart