CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 12 Nov 2024, 1,184 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 100%
EPSS score, percentile 100 of all scored records
- How severe?
- 5.3 Medium
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
Required action (CISA), due 3 Dec 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected: before 8.5.14; 8.6.0; before 8.13.6; 8.14.0; before 8.16.1; before 8.5.14; 8.6.0; before 8.13.6; 8.14.0; before 8.16.1
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: 3 December 2024.
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | before 8.5.14 |
| Affected | 8.6.0 |
| Affected | before 8.13.6 |
| Affected | 8.14.0 |
| Affected | before 8.16.1 |
| Status | Versions |
|---|---|
| Affected | before 8.5.14 |
| Affected | 8.6.0 |
| Affected | before 8.13.6 |
| Affected | 8.14.0 |
| Affected | before 8.16.1 |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2021-26086 to its Known Exploited Vulnerabilities (KEV) catalog on 12 Nov 2024.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 3 Dec 2024.
- The CVE record was published on 16 Aug 2021, 1,184 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 5.3 (Medium), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 16 Aug 2021 | CVE record published |
| 12 Nov 2024 | Added to CISA KEV |
| 3 Dec 2024 | CISA due date for the required action |
| 21 Oct 2025 | CVE record last updated |
References
More exploited Atlassian vulnerabilities
- CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability
- CVE-2023-22518: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
- CVE-2023-22515: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
- CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
- CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability