{"id":"CVE-2021-26084","kind":"vulnerability","aliases":["CVE-2021-26084"],"related":[],"title":"Atlassian Confluence Server and Data Center: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.","summary":"Atlassian Confluence Server and Data Center has an OGNL injection flaw that lets an unauthenticated attacker run code on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog and EPSS scores it as exploited.","severity":"critical","cvss":9.8,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Atlassian Confluence Server and Data Center","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["confluence","exploited","java","ransomware","runtime","self-hosted"],"not_affected_if":["atlassian-cloud","managed-hosting"],"how_to_check":null,"fix":"Apply the update from Atlassian's vendor advisory; the sources do not name the fixed version.","status":"open","published_at":"2021-08-30T07:15:06+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:48+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:33:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the update from Atlassian's vendor advisory; the sources do not name the fixed version.\nunknown","reach":"internet","impact":"high","summary":"Atlassian Confluence Server and Data Center has an OGNL injection flaw that lets an unauthenticated attacker run code on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog and EPSS scores it as exploited.","category":"runtime","who_cares":["confluence","self-hosted","java"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the Confluence server and can read its data.","analyst_note":"Find the fixed Confluence versions and a version check or detection method in Atlassian's advisory for CVE-2021-26084, linked from the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","atlassian-cloud"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000473,"input_tokens":2883,"output_tokens":370,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the fixed Confluence versions and a version check or detection method in Atlassian's advisory for CVE-2021-26084, linked from the CISA KEV entry.","search":"'-2021':22A,25A '-26084':23A,26A '6.13.23':116C '6.14.0':119C '7.11.6':126C '7.12.0':130C '7.12.5':132C '7.4.11':121C '7.5.0':124C 'affect':79C,111C 'allow':94C 'and':30A 'arbitrari':100C 'atlassian':1A,7A,27A,41B 'attack':56B,97C 'catalog':71B 'center':6A,12A,32A,46B,86C,108C 'cisa':66B 'code':58B,101C 'confluenc':2A,8A,33B,42B,82C,104C 'confluence':28A 'cve':21A,24A 'data':5A,11A,31A,45B,85C,107C 'epss':73B 'execut':99C 'exist':91C 'exploit':34B,69B,77B 'flaw':51B 'graph':15A 'host':40B 'inject':19A,50B,89C 'instanc':109C 'java':35B 'known':68B 'languag':17A 'let':53B 'list':64B 'navig':16A 'object':14A 'object-graph':13A 'ognl':18A,49B,88C 'ransomwar':36B 'run':57B 'runtim':37B 'score':74B 'self':39B 'self-host':38B 'server':3A,9A,29A,43B,61B,83C,105C 'unauthent':55B,96C 'version':80C,112C,115C,118C,123C,129C 'vulner':20A,70B,90C 'would':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-08-30T07:15:06+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-26084","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-26084","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2021-26084","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26084","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-26084","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26084","severity":null,"published_at":"2021-08-30T07:15:06+00:00","modified_at":"2026-06-17T03:42:49+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}