Skip to content
COOEY

FAIL › dossier

Jira Server and Data Center

PRODUCT

· dossier confidence 20%

Jira Server and Data Center is a self-hosted issue tracking product from Atlassian with a documented history of high-severity vulnerabilities including RCE and path traversal. The vendor has issued critical patches for recent flaws but continues to face third-party component supply chain risks.

Failure events
2
Zero-days
0
RCEs
1
On KEV
2
Critical
0
Worst shame
65
PROFILE
CategoryProductWhat they doJira Server and Data Center is a self-hosted project and issue tracking software developed by Atlassian. Websitehttps://www.atlassian.com/software/jira ↗
SECURITY POSTURE

Atlassian Jira Server and Data Center has a history of high-severity vulnerabilities including remote code execution and remote path traversal, with recent critical patches addressing stored XSS and OS command injection in related products.

Notable failures
  • CVE-2019-11581: Server-side template injection RCE
  • CVE-2021-26086: Remote path traversal file read
  • CVE-2026-21580: Stored XSS in Confluence
Patterns: repeated high-severity RCE and XSS vulnerabilities in self-hosted products; delayed patching of third-party component vulnerabilities (e.g., Netplex Json-smart, io.netty)
FAILURE HISTORY · 2
DATEEVENTSEVSUMMARY
2022-03-07 CVE-2019-11581 high Atlassian Jira Server and Data Center suffered a server-side template injection vulnerability allowing remote code execution.
2024-11-12 CVE-2021-26086 high Atlassian Jira Server/Data Center suffered a remote path traversal vulnerability (CVE-2021-26086) allowing file read access to /WEB-INF/web.xml.
DOSSIER SOURCES
Open questions: Are there any recent post-2024 vulnerabilities affecting Jira Server/Data Center? · What specific mitigation steps did Atlassian implement after CVE-2019-11581 and CVE-2021-26086?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-07 03:54:35.780686+00:00