CVE-2019-11581: Atlassian Jira Server and Data Center server-side template injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, active exploitation per CISA KEV, and a very high EPSS probability make this an urgent patching priority.

What it is

Jira Server and Data Center contain a server-side template injection flaw in the ContactAdministrators and SendBulkMail actions. An attacker can inject template expressions that are evaluated server-side, leading to remote code execution on vulnerable installations. The affected range spans many releases from 4.4.0 up to before 8.2.3, so unpatched deployments are broadly exposed.

Impact

Successful exploitation gives the attacker remote code execution on the Jira host, allowing full compromise of confidentiality, integrity and availability of the application and its data.

Attack surface

The flaw is reachable over the network through the ContactAdministrators and SendBulkMail actions, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

The vulnerability is listed in CISA KEV with a 2022-03-07 addition date, and EPSS reports a 30-day exploitation probability of 0.84621 (99.7th percentile), indicating active exploitation in the wild. No ransomware campaign use is documented in the record.

What to do

• Upgrade Jira Server and Data Center to a fixed release: 7.6.14, 7.13.5, 8.0.3, 8.1.2 or 8.2.3 depending on your branch.
• If immediate patching is not possible, restrict network access to the Jira instance and disable or block the ContactAdministrators and SendBulkMail functionality.
• Monitor Atlassian advisories and the JRASERVER-69532 ticket for updated guidance and any backported fixes.
• Verify no unauthorized administrative accounts or outbound connections exist on Jira hosts, and rotate credentials if compromise is suspected.

Detection

• Review Jira application and access logs for unusual requests to ContactAdministrators and SendBulkMail endpoints, especially with template-like payloads.
• Hunt for unexpected child processes spawned by the Jira Java process (for example shells or scripting interpreters).
• Monitor for outbound network connections from Jira servers to unfamiliar hosts that could indicate post-exploitation activity.
• Check for anomalous file writes or new files in Jira web directories and temporary paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.