CVE-2021-26084
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Nov 3, 2021
- US federal agencies must remediate it by Nov 17, 2021 (BOD 22-01)
- First attack observed 9 days after disclosure
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Apply updates per vendor instructions.
Source: CISA KEV · Nov 1, 2026 Oct 31, 2026 Oct 30, 2026 Oct 29, 2026 Oct 29, 2026 Oct 28, 2026
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-917, CWE-917
Vendorsatlassian
Affected products
| Vendors | Product | Versions |
|---|---|---|
| atlassian | confluence data center | < 6.13.23 |
| atlassian | confluence server | < 6.13.23 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.