CVE-2021-26084

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

Vendor	Product	Versions
Atlassian	Confluence Server	>= unspecified, < 6.13.23; >= 6.14.0, < unspecified; >= unspecified, < 7.4.11; >= 7.5.0, < unspecified; >= unspecified, < 7.11.6; >= 7.12.0, < unspecified; >= unspecified, < 7.12.5
Atlassian	Confluence Data Center	>= unspecified, < 6.13.23; >= 6.14.0, < unspecified; >= unspecified, < 7.4.11; >= 7.5.0, < unspecified; >= unspecified, < 7.11.6; >= 7.12.0, < unspecified; >= unspecified, < 7.12.5

References

http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CONFSERVER-67940Issue Tracking, Patch, Vendor Advisory
http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CONFSERVER-67940Issue Tracking, Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084US Government Resource

Timeline

Published: Aug 30, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-260855.3Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File CVE-2021-260865.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilit CVE-2021-260876.1An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, CVE-2021-260889.6An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO fire CVE-2021-260897.8An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell CVE-2021-260907.5A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2 CVE-2021-260917.5A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service CVE-2021-260926.1Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 thro CVE-2021-260936.5An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated CVE-2021-260958.8The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, includin CVE-2021-260968.8Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to ma CVE-2021-260978.8An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4,