TI-2026-17398 Aliases CVE-2026-21569 GHSA-5x73-r429-p343

XML external entity injection in Atlassian Crowd Data Center

LOW 34CWE-611Published 2026-01-28 · Updated 2026-01-28

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · Low · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Atlassian (Internal) program.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00329 26th percentileScored 2026-11-07

Fix Fixed Crowd Data Center (Atlassian): 7.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Crowd Data Center	7.1.0 to 7.1.2	7.1.3	Patch available	CNA

Crowd Data Center VendorAtlassian Affected 7.1.0 to 7.1.2 Fixed in 7.1.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:crowd::::::::	7.1.0 to before 7.1.3	Vulnerable	Atlassian

cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions 7.1.0 to before 7.1.3 Vulnerable ·Atlassian

Remediation

Fix · CNA Crowd Data Center (Atlassian) Fixed in 7.1.3

Timeline

2026-10-02 Threatist record created from CVE-2026-21569
2026-10-03 Alias added: GHSA-5x73-r429-p343

References

Advisory 2

TI-2019-08653 Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly… KEVCVSS 3.1CRITICAL 9.8
TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
TI-2022-21516 Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd… CVSS 3.1CRITICAL 9.8
TI-2016-05568 The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5… CVSS 3.0CRITICAL 9.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences