All vulnerabilities
CVE-2021-26084

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian Confluence Server and Data CenterApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 3 Nov 2021. Known ransomware useCISA KEV
Exploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.13.23Also 7.4.11, 7.11.6 and 1 moreCVE List
Federal deadline17 Nov 2021Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 25 Aug 2021Exploit code publicMetasploit
  2. 30 Aug 2021, 06:30 UTCPublishedCVE List
  3. 3 Nov 2021Added to CISA KEVCISA KEV

Public exploit code and templates 3

  • Exploit moduleAtlassian Confluence WebWork OGNL Injection 25 Aug 2021Metasploit
  • Webapps exploitConfluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated) 1 Sep 2021Exploit-DB
  • Scanner templateConfluence Server - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.

Text from CVE List

Affected versions 14

  • Confluence Serveraffected: unspecified before 6.13.23CVE List
  • Confluence Serveraffected: 6.14.0 before unspecifiedCVE List
  • Confluence Serveraffected: unspecified before 7.4.11CVE List
  • Confluence Serveraffected: 7.5.0 before unspecifiedCVE List
  • Confluence Serveraffected: unspecified before 7.11.6CVE List
  • Confluence Serveraffected: 7.12.0 before unspecifiedCVE List
  • Confluence Serveraffected: unspecified before 7.12.5CVE List
  • Confluence Data Centeraffected: unspecified before 6.13.23CVE List
  • Confluence Data Centeraffected: 6.14.0 before unspecifiedCVE List
  • Confluence Data Centeraffected: unspecified before 7.4.11CVE List
  • Confluence Data Centeraffected: 7.5.0 before unspecifiedCVE List
  • Confluence Data Centeraffected: unspecified before 7.11.6CVE List
  • Confluence Data Centeraffected: 7.12.0 before unspecifiedCVE List
  • Confluence Data Centeraffected: unspecified before 7.12.5CVE List

References 3