CVEvulnerability

CVE-2021-26084

9.8 CRITICAL Known exploited Published 2021-08-30 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability — Atlassian Confluence Server and Data Center

Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.

Added to KEV: 2021-11-03
Remediation due: 2021-11-17
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-26084

Status: Analyzed
Published: 2021-08-30
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-917

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Affected configurations

• atlassian confluence data center (< 6.13.23) • atlassian confluence data center (>= 6.14.0 < 7.4.11) • atlassian confluence data center (>= 7.5.0 < 7.11.6) • atlassian confluence data center (>= 7.12.0 < 7.12.5) • atlassian confluence server (< 6.13.23) • atlassian confluence server (>= 6.14.0 < 7.4.11) • atlassian confluence server (>= 7.5.0 < 7.11.6) • atlassian confluence server (>= 7.12.0 < 7.12.5)

Weakness · CWE (1)

CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References