Actively exploited in the wild

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian - Confluence Server and Data Center · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-26084

CriticalCVSS 9.8KEV

Published: 30/08/2021(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Risk Assessment

An attacker can gain full control of the Confluence server, potentially leading to data theft, service disruption, and further attacks within the network.

Recommendation

Immediately update Confluence to a patched version or apply temporary mitigation measures.

Other vulnerabilities in Confluence Server and Data Center

CVE-2022-26134CriticalActively exploited
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that allows an unauthenticated attacker to execute arbitrary code on the instance. Affected versions range from 1.3.0 before 7.4.17, 7.13.0 before 7.13.7, 7.14.0 before 7.14.3, 7.15.0 before 7.15.2, 7.16.0 before 7.16.4, 7.17.0 before 7.17.4, and 7.18.0 before 7.18.1.

Original NVD description (English source)

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.