CVE-2021-26086: Atlassian Jira Server and Data Center path traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a near-maximum EPSS score and public exploit references, though CVSS impact is limited to low confidentiality.

What it is

Jira Server and Data Center contain a path traversal flaw in the /WEB-INF/web.xml endpoint that lets remote attackers read particular files. The affected versions are before 8.5.14, 8.6.0 before 8.13.6, and 8.14.0 before 8.16.1. Although CVSS rates it medium, it is listed in CISA KEV and has a near-certain EPSS score, so it warrants prompt attention.

Impact

An unauthenticated remote attacker can read files exposed through the traversal, potentially disclosing configuration or other sensitive data. The CVSS vector limits impact to low confidentiality with no integrity or availability effect.

Attack surface

Reachable over the network via the /WEB-INF/web.xml endpoint; the CVSS vector shows no privileges or user interaction required. No authentication is needed per the vector.

Exploitation

CISA added it to KEV on 2024-11-12 with a 2024-12-03 due date, and EPSS is 0.99999 (99.992 percentile). Public exploit references are tagged Exploit, indicating working exploit code exists.

What to do

• Upgrade Jira Server and Data Center to a fixed release: 8.5.14 or later, 8.13.6 or later, or 8.16.1 or later as applicable.
• If immediate patching is not possible, apply the vendor mitigations referenced in JRASERVER-72695 or discontinue use of the product per CISA guidance.
• Restrict network access to Jira instances so only trusted users and networks can reach the web interface.
• Monitor Atlassian advisories and CISA KEV for updated guidance and due dates.

Detection

• Review web server and Jira access logs for requests to /WEB-INF/web.xml or traversal sequences such as ../.
• Alert on unusual file-read patterns or encoded traversal strings in request URIs.
• Correlate outbound or internal access to sensitive files with requests from unauthenticated sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.