9.8

CVE-2021-26084: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

KEVRansomware
Analyzed
Published 30-08-2021Last modified 16-12-2025

Vulnerability summary

CVE-2021-26084 is a critical (CVSS 9.8) vulnerability in Atlassian Confluence Server and Data Center. It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Priority
Act nowransomware

Known ransomware use (CISA, 03-11-2021)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareKnown useFlagged by CISA
Public exploits3reference, exploit-database, metasploit

Timeline

  1. 30-08-2021
    PublishedVulnerability first disclosed.
  2. 03-11-2021
    Added to CISA KEVExploitedAtlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
  3. 17-11-2021
    CISA remediation dueDeadline passedApply updates per vendor instructions.
  4. 16-12-2025
    Last modifiedVulnerability information updated.

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 100.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
03-11-2021
Federal due date
17-11-2021
Ransomware
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-26084

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • exploit-databasejavaUnverified

    Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Atlassian Confluence WebWork OGNL Injection

    exploit/multi/http/atlassian_confluence_webwork_ognl_injection

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian2 products
  • confluence_data_center≥ unspecified, < 6.13.23 | ≥ 6.14.0, < unspecified | ≥ unspecified, < 7.4.11 | ≥ 7.5.0, < unspecified | ≥ unspecified, < 7.11.6 | ≥ 7.12.0, < unspecified | ≥ unspecified, < 7.12.5 | < 6.13.23 | ≥ 6.14.0, < 7.4.11 | ≥ 7.5.0, < 7.11.6 | ≥ 7.12.0, < 7.12.5
  • confluence_server≥ unspecified, < 6.13.23 | ≥ 6.14.0, < unspecified | ≥ unspecified, < 7.4.11 | ≥ 7.5.0, < unspecified | ≥ unspecified, < 7.11.6 | ≥ 7.12.0, < unspecified | ≥ unspecified, < 7.12.5 | < 6.13.23 | ≥ 6.14.0, < 7.4.11 | ≥ 7.5.0, < 7.11.6 | ≥ 7.12.0, < 7.12.5

1 vendor · 2 products

References

3 links