What is the CVSS score of CVE-2026-21569?

CVE-2026-21569 has a CVSS 3.0 base score of 7.9 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Confluence are affected by CVE-2026-21569?

An unpatched XML injection vulnerability affecting Crowd Data Center and Server versions 7.1.0+ poses a significant risk to authentication and data access systems.

How to fix or mitigate CVE-2026-21569?

Within 24 hours: Identify and inventory all Crowd instances running version 7.1.0 or later; assess network exposure and restrict access to affected systems. Within 7 days: Implement WAF rules to block malicious XML payloads; enable request logging and monitoring for XXE attack patterns; evaluate upgrade paths to patched versions. Within 30 days: Execute upgrade to a patched version when available from Atlassian; conduct security testing post-remediation; review access logs for evidence of exploitation.

Confluence CVE-2026-21569

HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-01-28 security@atlassian.com

Atlassian Confluence XXE Crowd

7.9

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.9 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 01:16 nvd

HIGH 7.9

DescriptionCVE.org

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.

This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction.

Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3

See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive).

This vulnerability was reported via our Atlassian (Internal) program.

AnalysisAI

XXE injection in Atlassian Crowd Data Center and Server 7.1.0+ enables authenticated attackers to read local and remote files, significantly compromising confidentiality and availability. The vulnerability requires high privileges to exploit but accepts no user interaction, affecting multiple Crowd versions until patching to 7.1.3 or later. No patch is currently available for all affected versions.

Technical ContextAI

Classified as CWE-611 (Improper Restriction of XML External Entity Reference). Affects Crowd. This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.

Atlassian recommends that Crowd Data Center and Server customers upgrade to la