CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-26084
Critical (9.8) in Atlassian Confluence Server and Data Center. In CISA KEV since 2021-11-03, with known ransomware use. EPSS 100% chance of exploitation in the next 30 days.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2021-11-03, due 2021-11-17, known ransomware use
- CWE
- CWE-917
- Published
- Modified
- Record from
- the NVD, synced
Affected
- atlassian:confluence_data_center
- atlassian:confluence_server
References
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
- https://jira.atlassian.com/browse/CONFSERVER-67940
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
- https://jira.atlassian.com/browse/CONFSERVER-67940
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084