CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-26084 is a critical-severity Expression Language Injection (CWE-917) vulnerability in Atlassian Confluence Data Center. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-26084 is an OGNL injection vulnerability affecting Confluence Server and Data Center. The flaw exists in versions before 6.13.23, from 6.14.0 before 7.4.11, from 7.5.0 before 7.11.6, and from 7.12.0 before 7.12.5, and is tracked under CWE-917. It carries a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated remote attacker can supply malicious OGNL expressions to the affected instance and achieve arbitrary code execution on the underlying server, resulting in full confidentiality, integrity, and availability impact.
Atlassian’s Jira entry CONFSERVER-67940 and associated security advisory provide patch details and upgrade guidance to the fixed releases listed above. The vulnerability appears in CISA’s catalog of known exploited vulnerabilities, and public exploit code has been published on PacketStorm.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from…
more
version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.
CVEs Like This One
CVE-2022-26134Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2021-26085Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2023-22515Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2019-3396Same product: Atlassian Confluence Serverboth on KEV
CVE-2023-22527Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2019-3398Same product: Atlassian Confluence Serverboth on KEV
CVE-2023-22518Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2024-21677Same product: Atlassian Confluence Data Center
CVE-2022-26138Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2024-21690Same product: Atlassian Confluence Data Center
Affected Assets
atlassian
confluence data center
≤ 6.13.23 · 6.14.0 — 7.4.11 · 7.5.0 — 7.11.6
atlassian
confluence server
≤ 6.13.23 · 6.14.0 — 7.4.11 · 7.5.0 — 7.11.6
Mitigating Controls
Control response
Prevent
Stop it (NIST 800-53)
—
Detect
Catch it (NIST detect / respond)
—
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
V1.1.2
V1.3.2
V1.3.5
V4.3.1
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and safe EL construction to prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.