CVE-2026-21569 is a high-severity XXE (XML External Entity Injection) vulnerability affecting Atlassian Crowd Data Center and Server versions 7.1.0 and later. This vulnerability, with a CVSS score of 7.9, allows an authenticated attacker to access local and remote content, leading to high confidentiality and availability impact, with low integrity impact. Exploitation requires no user interaction and has high attack complexity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.1.0, < 7.1.3CPE matchmatch criteria | cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.