---
title: "Jira CVE-2021-26086: 2021 File-Read Bug Added to KEV in 2024"
url: https://erroneo.us/security/briefs/jira-cve-2021-26086-path-traversal-file-read/
description: "Unauthenticated limited file read in Jira Server/Data Center before 8.5.14, 8.13.6 and 8.16.1, added to KEV in Nov 2024. Find any Jira this old and retire it."
type: security-brief
section: "Security Digest"
date_published: 2021-08-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-26086"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Jira CVE-2021-26086: 2021 File-Read Bug Added to KEV in 2024

**Verdict: Check exposure.** The bug itself only leaks files, and any Jira from the last four years is fixed; the real job is to find any Jira 8.x this old still answering on the network and upgrade or retire it.

- **Who must act:** Anyone still running Jira Server or Data Center older than 8.5.14, 8.13.6 or 8.16.1, especially if it is reachable from the internet.
- **Who can relax:** Jira Cloud users and anyone on Jira 8.17.0 or any 9.x or later release.
- **Affected:** Jira Server and Data Center before 8.5.14; Jira Server and Data Center 8.6.0 to before 8.13.6; Jira Server and Data Center 8.14.0 to before 8.16.1
- **Fixed:** Jira 8.5.14; Jira 8.13.6; Jira 8.16.1; Jira 8.17.0 and all later releases
- **CVEs:** CVE-2021-26086
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Jira instance and its version (Administration > System > System info, or GET /rest/api/2/serverInfo).
2. Upgrade anything below 8.5.14, 8.13.6 or 8.16.1 to a supported Jira Data Center release, or migrate to Cloud; Jira Server has been unsupported since February 15, 2024.
3. Until then, take the instance off the internet and block request paths containing /WEB-INF/ at the reverse proxy or WAF.
4. Confirm the fix by running the public check against your own instance, for example nuclei -id CVE-2021-26086 -u https://jira.example.com.

### How to check if you are affected

- Search Jira's Tomcat access logs and proxy logs for requests containing ;/WEB-INF/ (the public exploit uses /s/<random>/_/;/WEB-INF/web.xml) that returned HTTP 200.
- Treat 200 responses from an outdated, internet-facing Jira as a sign of reconnaissance and review that server for other intrusion signs, since it has missed years of security fixes.

## What happened

On August 12, 2021, Atlassian published [JRASERVER-72695](https://jira.atlassian.com/browse/JRASERVER-72695), a "limited remote file read" in Jira Server and Data Center tracked as CVE-2021-26086. It is a path traversal flaw (CWE-22) that lets unauthenticated remote attackers "read particular files" through the `/WEB-INF/web.xml` endpoint. Atlassian and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-26086) rate it 5.3 (Medium), because it reads files but cannot change anything. Public exploit code exists. The widely used [nuclei check](https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2021/CVE-2021-26086.yaml) sends a single GET to `/s/<random>/_/;/WEB-INF/web.xml` and looks for the file's contents in the response.

More than three years later, on November 12, 2024, CISA added the bug to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086). Its [alert](https://www.cisa.gov/news-events/alerts/2024/11/12/cisa-adds-five-known-exploited-vulnerabilities-catalog) cites only "evidence of active exploitation" and names no actor. Two other old bugs were added the same day: Cisco ASA CVE-2014-2120 and Metabase CVE-2021-41277. All three appear in a [CloudSEK report](https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave) published six days earlier. CloudSEK obtained logs from misconfigured command servers of the Androxgh0st botnet, which it says exploited over 20 vulnerabilities from at least August 2024 and which it ties to the Mozi IoT botnet. That is the most likely trigger for the listing, but CISA has not confirmed it. CISA's ransomware flag for this CVE is "Unknown".

## Who is affected

Jira Server and Data Center before 8.5.14, 8.6.0 to before 8.13.6, and 8.14.0 to before 8.16.1 are affected. Fixed releases are 8.5.14, 8.13.6, 8.16.1 and 8.17.0, and every later version, including all of 9.x and 10.x, is fixed. The CVE does not cover Jira Cloud. Jira Server itself has been out of support since February 15, 2024, per Atlassian's [end-of-support FAQ](https://www.atlassian.com/licensing/server-end-of-support).

## Do you really need to act?

For most organizations, no. The bug only reads files, and any Jira patched in the last four years is fixed. What matters is what its presence says about a server. A Jira still on 8.16.0 or older has missed years of security fixes and is likely an orphaned or forgotten instance. At least one botnet has been exploiting it, per CloudSEK. So the verdict is to check exposure: find any such instance. If you find one, this is an upgrade-or-retire problem, not a patch.

## What to do now

1. Inventory Jira instances and versions under Administration > System > System info, or with `curl -s https://jira.example.com/rest/api/2/serverInfo` and read the `version` field.
2. Upgrade anything below the fixed versions to a supported Jira Data Center release, or migrate to Cloud.
3. Until then, remove internet access, and block any request path containing `/WEB-INF/` at the reverse proxy or WAF. Atlassian's ticket points to a proxy or load-balancer workaround.
4. Verify against your own instance: `nuclei -id CVE-2021-26086 -u https://jira.example.com`.

## How to tell if you were hit

Search Jira's Tomcat access logs and your proxy logs for request paths containing `;/WEB-INF/`, for example `grep -E ';/WEB-INF/' access_log*`, and focus on HTTP 200 responses. Misses (404s) are just background scanning. A 200 on an old, internet-facing instance means someone read configuration files. That alone is low impact, but such a server is also open to whatever later Jira flaws it never received. Review it for unknown admin accounts, unexpected add-ons and odd outbound traffic, and plan its replacement.

## Timeline

- Aug 12, 2021 — Atlassian publishes JRASERVER-72695.
- Aug 16, 2021 — CVE-2021-26086 is published.
- Feb 15, 2024 — Atlassian ends support for Server products.
- Nov 6, 2024 — CloudSEK's Androxgh0st report lists CVE-2021-26086 among the botnet's exploits.
- Nov 12, 2024 — CISA adds CVE-2021-26086 to KEV (due December 3, 2024).

## Sources

1. [Atlassian — JRASERVER-72695: Limited remote file read in Jira Software Server (CVE-2021-26086)](https://jira.atlassian.com/browse/JRASERVER-72695)
2. [CVE record — CVE-2021-26086](https://www.cve.org/CVERecord?id=CVE-2021-26086)
3. [NVD — CVE-2021-26086](https://nvd.nist.gov/vuln/detail/CVE-2021-26086)
4. [CISA — Known Exploited Vulnerabilities: CVE-2021-26086](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086)
5. [CISA — CISA adds five known exploited vulnerabilities to catalog (Nov 12, 2024)](https://www.cisa.gov/news-events/alerts/2024/11/12/cisa-adds-five-known-exploited-vulnerabilities-catalog)
6. [CloudSEK — Mozi resurfaces as Androxgh0st botnet: unraveling the latest exploitation wave](https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave)
7. [ProjectDiscovery — nuclei template CVE-2021-26086](https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2021/CVE-2021-26086.yaml)
8. [Atlassian — Server end of support FAQ](https://www.atlassian.com/licensing/server-end-of-support)

---
Source page: https://erroneo.us/security/briefs/jira-cve-2021-26086-path-traversal-file-read/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt