CVE-2026-21587

CVE-2026-21587 is a high-severity improper authorization (broken access control) flaw affecting Jira Service Management Data Center, introduced in version 11.3.0 and rated 7.1 under CVSS 4.0. An authenticated attacker with low privileges can exploit missing or incorrect authorization checks over the network without user interaction to gain unintended access to resources or functionality. According to Atlassian, this can expose sensitive information and, in some scenarios, allow execution of arbitrary code, with the CVSS vector confirming a high impact on integrity. Only self-hosted Jira Service Management Data Center instances running 11.3.0 through 11.3.10 are affected; Cloud deployments are not. The issue was found through Atlassian's penetration testing program, and no public proof of concept or known in-the-wild exploitation exists at this time.

What to do: Upgrade Jira Service Management Data Center 11.3.x instances to 11.3.11 or the latest version immediately, prioritizing any instance reachable from untrusted networks. Until patched, restrict access via VPN/IP allowlisting and review audit logs for low-privileged accounts accessing resources or functionality outside their expected permissions, including any signs of unexpected code execution.