Crowd Data Center CVE-2026-21582

The CVSS 4.0 AT:P metric confirms a specific attack requirement or precondition must be present on the target Crowd Data Center instance; however, the exact nature of this condition is not disclosed in the available intelligence - this is consistent with responsible disclosure from a penetration testing engagement where full technical details are withheld pending patch adoption. PR:N confirms no authentication is required of the attacker. UI:P indicates the attack requires passive interaction from a target user, such as an active session, an authentication flow in progress, or another triggerable identity context - the attacker cannot exploit this fully autonomously without that user-side component. The vulnerability is scoped exclusively to Crowd Data Center version 7.2.1; prior versions are not listed as affected, and version 7.2.2 is confirmed fixed. Limiting factors that reduce mass-exploitation risk: elevated attack complexity (AC:H), mandatory specific precondition (AT:P), and required passive user interaction (UI:P) collectively constrain this to targeted attacks by capable adversaries rather than automated scanning campaigns.

The CVSS 4.0 score of 8.8 reflects a serious but not trivially exploitable vulnerability: AV:N/AC:H/AT:P/PR:N indicates it is remotely reachable without credentials, yet demands elevated attack complexity and the presence of a specific precondition, meaningfully reducing the probability of opportunistic mass exploitation compared to simpler AC:L/AT:N flaws. The UI:P requirement further constrains automated, fully hands-off exploitation. No CISA KEV listing exists and no public proof-of-concept code has been identified, suggesting current exploitation risk sits within the capability envelope of skilled, targeted adversaries rather than commodity threat actors - an assessment that should be revisited if a POC emerges. EPSS data was not included in the provided intelligence, which is a gap worth noting when prioritizing against other queue items. However, the scope-changing subsequent-system impacts (SC:H, SI:H) are the critical risk amplifier here: Crowd functions as a trust anchor, so a single successful impersonation attack yields lateral movement potential across all federated applications, meaning even a mid-sized municipal IT team in boleslawiec running Crowd as the authentication backbone for a dozen internal services should treat this as an urgent remediation, not a routine patch-cycle item. The combination of PR:N (no auth needed) and cross-system high-integrity impact elevates real-world priority above what the AC:H might otherwise suggest.

An attacker with network access to a Crowd Data Center 7.2.1 instance identifies the specific precondition required for exploitation (AT:P) - potentially a particular session state, timing window, or configuration - and crafts a malformed authentication or session assertion request. With minimal passive involvement from a target user (UI:P), the attacker exploits the broken session management logic to assert the victim's identity to the Crowd platform. The attacker then uses the impersonated session to access downstream SSO-federated applications (Jira, Confluence, or third-party services) as the targeted user, with no public exploit code currently available to lower the skill bar for this attack.