Improper authentication in Atlassian Jira Core Server
Priority CRITICAL 91CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.
Summary
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.88057 99th percentileScored 2026-11-07
Fix Fixed Jira Core Server (Atlassian): 8.13.18, 8.20.6, 8.22.0Jira Software Server (Atlassian): 8.13.18, 8.20.6, 8.22.0+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Atlassian | Jira Core Server | before 8.13.18; 8.14.0 and later; before 8.20.6; 8.21.0 and later; before 8.22.0 | 8.13.18, 8.20.6, 8.22.0 | Patch available | CNA |
| Atlassian | Jira Software Server | before 8.13.18; 8.14.0 and later; before 8.20.6; 8.21.0 and later; before 8.22.0 | 8.13.18, 8.20.6, 8.22.0 | Patch available | CNA |
| Atlassian | Jira Software Data Center | before 8.13.18; 8.14.0 and later; before 8.20.6; 8.21.0 and later; before 8.22.0 | 8.13.18, 8.20.6, 8.22.0 | Patch available | CNA |
| Atlassian | Jira Service Management Server | before 4.13.18; 4.14.0 and later; before 4.20.6; 4.21.0 and later; before 4.22.0 | 4.13.18, 4.20.6, 4.22.0 | Patch available | CNA |
| Atlassian | Jira Service Management Data Center | before 4.13.18; 4.14.0 and later; before 4.20.6; 4.21.0 and later; before 4.22.0 | 4.13.18, 4.20.6, 4.22.0 | Patch available | CNA |
- Jira Core Server VendorAtlassian Affected before 8.13.18; 8.14.0 and later; before 8.20.6; 8.21.0 and later; before 8.22.0 Fixed in 8.13.18, 8.20.6, 8.22.0 Patch available CNA
- Jira Software Server VendorAtlassian Affected before 8.13.18; 8.14.0 and later; before 8.20.6; 8.21.0 and later; before 8.22.0 Fixed in 8.13.18, 8.20.6, 8.22.0 Patch available CNA
- Jira Software Data Center VendorAtlassian Affected before 8.13.18; 8.14.0 and later; before 8.20.6; 8.21.0 and later; before 8.22.0 Fixed in 8.13.18, 8.20.6, 8.22.0 Patch available CNA
- Jira Service Management Server VendorAtlassian Affected before 4.13.18; 4.14.0 and later; before 4.20.6; 4.21.0 and later; before 4.22.0 Fixed in 4.13.18, 4.20.6, 4.22.0 Patch available CNA
- Jira Service Management Data Center VendorAtlassian Affected before 4.13.18; 4.14.0 and later; before 4.20.6; 4.21.0 and later; before 4.22.0 Fixed in 4.13.18, 4.20.6, 4.22.0 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* | before 8.13.8; 8.14.0 to before 8.20.6; 8.21.0 to before 8.22.0 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* | before 8.13.8; 8.14.0 to before 8.20.6; 8.21.0 to before 8.22.0 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* | before 4.13.8 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* | before 4.13.18; 4.14.0 to before 4.20.6 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* | 4.14.0 to before 4.20.6 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* | 4.21.0 to before 4.22.0 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* | 4.21.0 to before 4.22.0 | Vulnerable | Atlassian |
- cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions before 8.13.8; 8.14.0 to before 8.20.6; 8.21.0 to before 8.22.0 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions before 8.13.8; 8.14.0 to before 8.20.6; 8.21.0 to before 8.22.0 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions before 4.13.8 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions before 4.13.18; 4.14.0 to before 4.20.6 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.14.0 to before 4.20.6 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.21.0 to before 4.22.0 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.21.0 to before 4.22.0 Vulnerable ·Atlassian
Remediation
- Fix · CNA Jira Core Server (Atlassian) Fixed in 8.13.18, 8.20.6, 8.22.0
- Fix · CNA Jira Software Server (Atlassian) Fixed in 8.13.18, 8.20.6, 8.22.0
- Fix · CNA Jira Software Data Center (Atlassian) Fixed in 8.13.18, 8.20.6, 8.22.0
- Fix · CNA Jira Service Management Server (Atlassian) Fixed in 4.13.18, 4.20.6, 4.22.0
- Fix · CNA Jira Service Management Data Center (Atlassian) Fixed in 4.13.18, 4.20.6, 4.22.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0540
- 2026-10-03 Alias added: GHSA-h5cm-vc68-69h9
References
More Atlassian Jira Data Center vulnerabilities
- TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
- TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
- TI-2021-08038 Path traversal in Atlassian Jira Server KEVCVSS 3.1MEDIUM 5.3
- TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
- TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
- TI-2022-09597 Server-side request forgery in Atlassian Jira Core Server CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-0540 · CVE Program
- CVE-2022-0540 · NVD
- FIRST EPSS
- GHSA-h5cm-vc68-69h9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences