Atlassian Crowd vulnerabilities

24 CVEs affecting Atlassian Crowd, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21569, published 2026-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11580: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability, published 2019-06-03. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.4% chance of exploitation in the next 30 days. Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd…
CVE-2012-2926, published 2012-05-22. Critical severity, CVSS 9.1. EPSS: 66.3% chance of exploitation in the next 30 days. Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and…
CVE-2022-26136, published 2022-07-20. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by…
CVE-2016-6496, published 2016-12-09. Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days. The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka…
CVE-2018-20239, published 2019-04-30. Medium severity, CVSS 5.4. EPSS: 3.3% chance of exploitation in the next 30 days. Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote…
CVE-2019-20104, published 2020-02-06. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion…
CVE-2022-26137, published 2022-07-20. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.…
CVE-2017-18108, published 2019-03-29. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection.
CVE-2013-3926, published 2013-07-01. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not reproduce the issue,…
CVE-2013-3925, published 2013-07-01. Medium severity, CVSS 5.8. EPSS: 1.8% chance of exploitation in the next 30 days. Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or…

Latest

CVE-2026-21569, published 2026-01-28. High severity, CVSS 7.9. EPSS: 0.3% chance of exploitation in the next 30 days. This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with…
CVE-2023-22521, published 2023-11-21. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of…
CVE-2022-43782, published 2022-11-17. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API…
CVE-2020-36240, published 2021-03-01. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF…
CVE-2019-20902, published 2020-10-01. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.
CVE-2017-18107, published 2019-12-17. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF)…
CVE-2019-15005, published 2019-11-08. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to…