Vulnerability Report

CVE-2026-21569

Title: XXE in Atlassian Crowd Data Center and Server

XXE

Proof Of Concept

No public PoC currently indexed for CVE-2026-21569.

CWE Category NVD-CWE-noinfo

Published Date Jan 28, 2026

Modified Date Feb 02, 2026

Exploit Status Not Found

Score 7.9 CVSS v3.0

Exploit Probability (EPSS)

0.30%

Vulnerability Summary

CVE-2026-21569: This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Atlassian (Internal) program.

Impacted Vendors

atlassian 1

Reference Links

https://confluence.atlassian.com/pages/viewpage.action?pageId=1712324819 https://jira.atlassian.com/browse/CWD-6453

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.9

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns