Atlassian - Path Traversal (CVE-2021-26086)
Description
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
psychologyCrowdSec Analysis
CVE-2021-26086 is a vulnerability in Atlassian Jira Server and Data Center that allows remote attackers to perform path traversal and access sensitive files, particularly through the /WEB-INF/web.xml endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 13th of December 2021.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2021-26086 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-26086 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-26086 is currently experiencing high visibility and active exploitation across the internet.
Observed attempts focus on accessing resources at the /WEB-INF/web.xml path.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-08-16 |
| Rule Released | 2021-12-13 |
| CrowdSec First Seen | 2021-12-13 |
| CISA KEV | 2024-11-12 |
| CISA Remediation Deadline | 2024-12-03 |