# CVE-2021-26086: Atlassian - Path Traversal

> Live exploitation tracking for CVE-2021-26086 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-26086

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Atlassian Jira Data Center
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

## CrowdSec analysis

[CVE-2021-26086](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-26086) is a vulnerability in Atlassian Jira Server and Data Center that allows remote attackers to perform path traversal and access sensitive files, particularly through the `/WEB-INF/web.xml` endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 13th of December 2021.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2021-26086 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-26086 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-26086 is currently experiencing high visibility and active exploitation across the internet.

Observed attempts focus on accessing resources at the `/WEB-INF/web.xml` path.

## Timeline

- 2021-08-16: CVE Published. CVE-2021-26086 is published to NVD.
- 2021-12-13: Rule Released. CrowdSec releases a rule to detect CVE-2021-26086 exploitation attempts against the CrowdSec Network.
- 2021-12-13: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-26086 for the first time.
- 2024-11-12: CISA KEV. CVE-2021-26086 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-12-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://jira.atlassian.com/browse/JRASERVER-72695
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26086.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-26086) follows observed exploitation activity for CVE-2021-26086. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.