CVE-2019-11580VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2019-11580: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

Affects Atlassian Crowd and Crowd Data CenterSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
Ransomware: Used in ransomware campaigns
EPSS: 95.4% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-11580 (opens in a new tab)

Description

Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability due to a development plugin (pdkinstall) being incorrectly enabled in release builds. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Summary

CVE-2019-11580 is a remote code execution vulnerability in Atlassian Crowd and Crowd Data Center products. The issue arises because a development plugin named pdkinstall was mistakenly enabled in production releases, allowing attackers to execute arbitrary code remotely. This vulnerability has been observed to be exploited in the wild and linked to ransomware activities. The input data does not specify affected versions or remediation status.

Impact

Successful exploitation allows remote attackers to execute arbitrary code on affected Atlassian Crowd and Crowd Data Center instances. This can lead to full system compromise, data breaches, and facilitation of ransomware attacks. The vulnerability has been actively exploited in the wild, increasing the risk to affected organizations.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the severity and active exploitation, organizations should consult Atlassian's official advisories and apply any available updates or workarounds promptly.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:40:25 UTC

References

Related threats