CVE-2022-0540: Atlassian Jira Seraph authentication bypass via crafted HTTP request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or user interaction, and very high EPSS make this an urgent patch target despite no KEV listing.

What it is

Jira Server, Data Center and Jira Service Management contain an authentication bypass in the Seraph component, reachable by sending a specially crafted HTTP request. Because the flaw defeats authentication entirely and the affected products are widely deployed, it exposes both confidentiality and integrity of the instance.

Impact

An unauthenticated attacker can bypass authentication and act with the privileges the bypass grants, gaining access to data and functionality that should require login.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed Jira instance in the affected version ranges is a candidate target.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.88057, 99.757th percentile), indicating strong likelihood of attempted exploitation. All references are vendor advisories and patch links, with no public exploit tag supplied.

What to do

• Upgrade Jira Server/Data Center to 8.13.18, 8.20.6 or 8.22.0 and later, and Jira Service Management Server/Data Center to 4.13.18, 4.20.6 or 4.22.0 and later, per the Atlassian advisory.
• If immediate patching is not possible, restrict network access to Jira instances to trusted networks and place them behind authentication-aware proxies.
• Review Jira access logs for anomalous unauthenticated requests and unexpected administrative or data-access activity.
• Confirm no unauthorized accounts, permission changes or configuration modifications were made during any exposure window.

Detection

• Hunt web/proxy logs for crafted or malformed HTTP requests to Jira endpoints that return success without a valid session.
• Alert on authenticated-looking activity from sessions with no preceding login event.
• Monitor for unexpected administrative actions, permission grants or bulk data access in Jira audit logs.
• Baseline normal Jira request patterns and flag deviations from unauthenticated source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.