Jira CVE-2021-26086: 2021 File-Read Bug Added to KEV in 2024

What to do

1. Inventory every Jira instance and its version (Administration > System > System info, or GET /rest/api/2/serverInfo).
2. Upgrade anything below 8.5.14, 8.13.6 or 8.16.1 to a supported Jira Data Center release, or migrate to Cloud; Jira Server has been unsupported since February 15, 2024.
3. Until then, take the instance off the internet and block request paths containing /WEB-INF/ at the reverse proxy or WAF.
4. Confirm the fix by running the public check against your own instance, for example nuclei -id CVE-2021-26086 -u https://jira.example.com.

How to check if you are affected or compromised

• Search Jira's Tomcat access logs and proxy logs for requests containing ;/WEB-INF/ (the public exploit uses /s/<random>/_/;/WEB-INF/web.xml) that returned HTTP 200.
• Treat 200 responses from an outdated, internet-facing Jira as a sign of reconnaissance and review that server for other intrusion signs, since it has missed years of security fixes.

What happened#

On August 12, 2021, Atlassian published JRASERVER-72695, a "limited remote file read" in Jira Server and Data Center tracked as CVE-2021-26086. It is a path traversal flaw (CWE-22) that lets unauthenticated remote attackers "read particular files" through the /WEB-INF/web.xml endpoint. Atlassian and NVD rate it 5.3 (Medium), because it reads files but cannot change anything. Public exploit code exists. The widely used nuclei check sends a single GET to /s/<random>/_/;/WEB-INF/web.xml and looks for the file's contents in the response.

More than three years later, on November 12, 2024, CISA added the bug to the KEV catalog. Its alert cites only "evidence of active exploitation" and names no actor. Two other old bugs were added the same day: Cisco ASA CVE-2014-2120 and Metabase CVE-2021-41277. All three appear in a CloudSEK report published six days earlier. CloudSEK obtained logs from misconfigured command servers of the Androxgh0st botnet, which it says exploited over 20 vulnerabilities from at least August 2024 and which it ties to the Mozi IoT botnet. That is the most likely trigger for the listing, but CISA has not confirmed it. CISA's ransomware flag for this CVE is "Unknown".

Who is affected#

Jira Server and Data Center before 8.5.14, 8.6.0 to before 8.13.6, and 8.14.0 to before 8.16.1 are affected. Fixed releases are 8.5.14, 8.13.6, 8.16.1 and 8.17.0, and every later version, including all of 9.x and 10.x, is fixed. The CVE does not cover Jira Cloud. Jira Server itself has been out of support since February 15, 2024, per Atlassian's end-of-support FAQ.

Do you really need to act?#

For most organizations, no. The bug only reads files, and any Jira patched in the last four years is fixed. What matters is what its presence says about a server. A Jira still on 8.16.0 or older has missed years of security fixes and is likely an orphaned or forgotten instance. At least one botnet has been exploiting it, per CloudSEK. So the verdict is to check exposure: find any such instance. If you find one, this is an upgrade-or-retire problem, not a patch.

What to do now#

1. Inventory Jira instances and versions under Administration > System > System info, or with curl -s https://jira.example.com/rest/api/2/serverInfo and read the version field.
2. Upgrade anything below the fixed versions to a supported Jira Data Center release, or migrate to Cloud.
3. Until then, remove internet access, and block any request path containing /WEB-INF/ at the reverse proxy or WAF. Atlassian's ticket points to a proxy or load-balancer workaround.
4. Verify against your own instance: nuclei -id CVE-2021-26086 -u https://jira.example.com.

How to tell if you were hit#

Search Jira's Tomcat access logs and your proxy logs for request paths containing ;/WEB-INF/, for example grep -E ';/WEB-INF/' access_log*, and focus on HTTP 200 responses. Misses (404s) are just background scanning. A 200 on an old, internet-facing instance means someone read configuration files. That alone is low impact, but such a server is also open to whatever later Jira flaws it never received. Review it for unknown admin accounts, unexpected add-ons and odd outbound traffic, and plan its replacement.

Timeline#

• Aug 12, 2021 — Atlassian publishes JRASERVER-72695.
• Aug 16, 2021 — CVE-2021-26086 is published.
• Feb 15, 2024 — Atlassian ends support for Server products.
• Nov 6, 2024 — CloudSEK's Androxgh0st report lists CVE-2021-26086 among the botnet's exploits.
• Nov 12, 2024 — CISA adds CVE-2021-26086 to KEV (due December 3, 2024).

Vulnerability records

• CVE-2021-26086 · KEV 2024-11-12 · Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Atlassian — JRASERVER-72695: Limited remote file read in Jira Software Server (CVE-2021-26086) jira.atlassian.com
2. CVE record — CVE-2021-26086 cve.org
3. NVD — CVE-2021-26086 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2021-26086 cisa.gov
5. CISA — CISA adds five known exploited vulnerabilities to catalog (Nov 12, 2024) cisa.gov
6. CloudSEK — Mozi resurfaces as Androxgh0st botnet: unraveling the latest exploitation wave cloudsek.com
7. ProjectDiscovery — nuclei template CVE-2021-26086 raw.githubusercontent.com
8. Atlassian — Server end of support FAQ atlassian.com