CompaniesJiraMonthly reportsMay 2026
Jira in May 2026: incidents, uptime and changes
6incidents posted
4labelled major or critical
98.15%free of major/critical
95.04%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 13 h 42 min, incident time 36 h 53 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Critical 2 · Major 2 · Minor 2
Major and critical incidents 4
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| The Work Item view experience of Jira is restored | Critical | 1.9 h | postmortem | 05-02 | |
| Users experiencing issues accessing multiple Atlassian products | Critical | 7 min | postmortem | 05-14 | |
| Jira users unable to log time while on business board | Major | 3.4 h | resolved | 05-06 | |
| Automations within Jira, Jira Service Management and JSM Assist experiencing delays for some users | Major | 8.4 h | postmortem | 05-13 |
Other incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Multiple Atlassian services are experiencing issues | Minor | 18 h | postmortem | 05-08 | |
| Forge custom fields are not getting created | Minor | 5.0 h | resolved | 05-20 |
CVEs published
- CVE-2026-6321 fast-uri vulnerable to path traversal via percent-encoded dot segments (CVSS 7.5)
- CVE-2026-6322 fast-uri vulnerable to host confusion via percent-encoded authority delimiters (CVSS 7.5)
- CVE-2026-42264 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking (CVSS 7.4)
- CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling (CVSS 7.5)
- CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure (CVSS 7.3)
- CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated (CVSS 9.8)
- CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user (CVSS 9.8)
- CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive (CVSS 7.5)
- CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied (CVSS 9.1)
- CVE-2026-42581 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization (CVSS 5.8)
- CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion (CVSS 7.5)
- CVE-2026-42584 Netty: HttpClientCodec response desynchronization (CVSS 7.3)
- CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding (CVSS 6.5)
- CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS (CVSS 7.5)
- CVE-2026-44728 Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs (CVSS 8.2)
- CVE-2026-47759 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes (CVSS 8.7)
- CVE-2026-47761 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection (CVSS 8.7)
- CVE-2026-47762 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments (CVSS 8.7)
Cite this
Jira posted 6 status incidents in May 2026 (4 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Jira in May 2026
- Vendor
- Jira
- Date
- URL
- https://rewindex.com/company/jira/2026/05