VULNERABILITY INTELLIGENCE

CVE-2021-26084

CVSS score9.8 CRITICAL

EPSS probability100.00%

CISA KEVKnown exploited vulnerability

Published2021-08-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Vendor / product: Atlassian / Confluence Server and Data Center

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Weakness classification

nvd@nist.gov: CWE-917
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-917

Primary references

security@atlassian.com — Exploit, Third Party Advisory, VDB Entry
security@atlassian.com — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource