CVE-2021-43947: Atlassian Data Center

High severity, CVSS 7.2. EPSS: 4.1% chance of exploitation in the next 30 days.

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

Affected products

• Atlassian Data Center: before 8.13.15 (fixed in 8.13.15)
• Atlassian Jira: before 8.13.15 (fixed in 8.13.15)
• Atlassian Jira Data Center: from 8.14.0, before 8.20.3 (fixed in 8.20.3)
• Atlassian Jira Server: from 8.14.0, before 8.20.3 (fixed in 8.20.3)

Published 2022-01-06. Last modified 2026-06-17.