CVE-2026-21569
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-02-02

Assigner: Atlassian

Description
This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Atlassian (Internal) program.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-28
Last Modified
2026-02-02
Generated
2026-05-07
AI Q&A
2026-01-29
EPSS Evaluated
2026-05-05
NVD
CVE-2026-21569
EUVD
EUVD-2026-4913
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
atlassian crowd From 7.1.0 (inc) to 7.1.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a High severity XML External Entity Injection (XXE) flaw found in version 7.1.0 of Crowd Data Center and Server. It allows an authenticated attacker to exploit XML processing to access local and remote content without requiring any user interaction. This can lead to unauthorized disclosure of sensitive information and potentially disrupt system availability.


How can this vulnerability impact me? :

The vulnerability can impact you by allowing an authenticated attacker to access confidential local and remote data, which compromises confidentiality. It also has a high impact on availability, potentially causing service disruptions, and a low impact on integrity. Since no user interaction is needed, the risk is significant once the attacker is authenticated.


What immediate steps should I take to mitigate this vulnerability?

Upgrade your Crowd Data Center and Server instance to version 7.1.3 or later, as recommended by Atlassian. If upgrading immediately is not possible, apply any available patches or mitigations provided by Atlassian. Refer to the official release notes and download the latest version from Atlassian's download center.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart