---
id: "CVE-2021-26084"
kind: "vulnerability"
aliases: ["CVE-2021-26084"]
title: "Atlassian Confluence Server and Data Center: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99999
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Atlassian Confluence Server and Data Center", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["confluence", "exploited", "java", "ransomware", "runtime", "self-hosted"]
not_affected_if: ["atlassian-cloud", "managed-hosting"]
published_at: "2021-08-30T07:15:06+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-26084", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-26084", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26084", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Atlassian Confluence Server and Data Center: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian Confluence Server and Data Center has an OGNL injection flaw that lets an unauthenticated attacker run code on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog and EPSS scores it as exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Confluence Server and Data Center affected ? fixed ?

## Fix

Apply the update from Atlassian's vendor advisory; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-26084
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-26084
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-26084

## From the sources

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_