CVE-2020-36239: Atlassian Jira Data Center Ehcache RMI service missing authentication RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required and a high EPSS score make this a top-priority remote code execution exposure for internet- or network-reachable Jira Data Center instances.

What it is

Jira Data Center, Jira Core Data Center, Jira Software Data Center and Jira Service Management Data Center exposed an Ehcache RMI network service on port 40001 (and potentially 40011) without authentication. An attacker able to reach that port can deserialize untrusted data and execute arbitrary code in the Jira process. Fixed versions require a shared secret to access the Ehcache service.

Impact

An unauthenticated network attacker gains arbitrary code execution in the Jira server process, which typically runs with the application's privileges and can lead to full compromise of the instance and its data.

Attack surface

Reached over the network via the exposed Ehcache RMI ports 40001 and potentially 40011; the CVSS vector shows no privileges or user interaction required. In some older versions the Ehcache object port is randomly allocated, so the exact port may vary.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is high at roughly 0.50 (98.8th percentile), indicating substantial predicted exploitation activity; references are vendor advisories and patch links only.

What to do

• Upgrade to a fixed Jira/Jira Service Management Data Center release (8.5.16, 8.13.8, 8.17.0 or later for Jira; 4.5.16, 4.13.8, 4.17.0 or later for Jira Service Management) so the Ehcache service requires a shared secret.
• Restrict network access to the Ehcache ports (40001 and 40011, or the randomly allocated object port) to only trusted Data Center cluster nodes.
• Block the Ehcache ports at the perimeter and between network segments so they are not reachable from untrusted networks.
• If immediate patching is not possible, isolate affected instances and monitor for unexpected connections to the Ehcache ports.

Detection

• Monitor network traffic and firewall logs for inbound connections to TCP 40001 and 40011 from hosts outside the Jira cluster.
• Alert on unexpected processes or child processes spawned by the Jira Java process.
• Review Jira and host logs for deserialization errors or unusual RMI/Ehcache activity around the service ports.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.