CVE-2019-11580: Atlassian Crowd pdkinstall plugin allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network RCE, CISA KEV listing with known ransomware use, and an EPSS score above the 99th percentile make this an urgent patch-first issue.

What it is

Atlassian Crowd and Crowd Data Center shipped release builds with the pdkinstall development plugin incorrectly enabled. An attacker who can reach the instance can install arbitrary plugins, which leads to remote code execution. Because the flaw is network-reachable and requires no authentication, it is a serious risk for any exposed Crowd deployment.

Impact

An attacker can install arbitrary plugins and execute code on the Crowd server, gaining full control of the host and any data it processes. This can lead to credential compromise, lateral movement, and complete system takeover.

Attack surface

Reached over the network via HTTP requests to the Crowd or Crowd Data Center instance; the CVSS vector shows no privileges or user interaction required, though the description notes both unauthenticated and authenticated requests can be used. Any internet- or network-exposed Crowd instance is a candidate.

Exploitation

CVE-2019-11580 is listed in CISA KEV with known ransomware campaign use, and EPSS shows a 30-day probability of 0.95355 (99.864th percentile). Public exploit code is referenced on Packet Storm, indicating active exploitation is feasible and observed.

What to do

• Upgrade Crowd and Crowd Data Center to a fixed version: 3.0.5, 3.1.6, 3.2.8, 3.3.5, or 3.4.4 as applicable.
• If immediate patching is not possible, disable or remove the pdkinstall plugin and restrict network access to the Crowd instance.
• Apply the vendor mitigation guidance in Atlassian issue CWD-5388.
• Place Crowd behind authentication-aware proxies or VPNs and limit exposure to trusted networks.
• Monitor for unexpected plugin installations and review plugin directories for unauthorized changes.

Detection

• Audit Crowd plugin directories and logs for unexpected or unauthorized plugin installations.
• Monitor HTTP requests to Crowd endpoints associated with pdkinstall or plugin upload functionality.
• Alert on new or modified files in Crowd plugin and web application directories.
• Correlate Crowd server process behavior with outbound network connections or child processes indicative of code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.