HackerFeeds
All CVEs

CVE-2021-26086

MEDIUM5.3
CISA KEV

Published 2021-08-16 · Updated 2026-06-17 · Source security@atlassian.com

Summary

CVE-2021-26086 is a medium-severity (CVSS 5.3) vulnerability in Atlassian Jira Server and Data Center. CISA added it to the Known Exploited Vulnerabilities catalog on November 12, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 3, 2024. CISA does not currently list it as used in ransomware campaigns. Atlassian has 14 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

All 14 known-exploited Atlassian vulnerabilities →

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-22CWE-22

CISA Known-Exploited Vulnerability

Product: Atlassian — Jira Server and Data Center

Name: Atlassian Jira Server and Data Center Path Traversal Vulnerability

Date added: 2024-11-12 · Due: 2024-12-03

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD