{"id":"CVE-2021-26084","published":"2021-08-30T07:15:06Z","modified":"2026-06-17T03:42:49Z","title":"Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","vendor":"Atlassian","product":"Confluence Server and Data Center","tier":"core","eol":null,"description":{"text":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.","provenance":"source","from":"NVD"},"summary":{"text":"Atlassian Confluence Server and Data Center contains an Object-Graph Navigation Language (OGNL) injection flaw, classified as improper neutralization of special elements in an expression language statement. An unauthenticated attacker with network access can exploit it, requiring no user interaction and no special configuration, to execute arbitrary code on the affected instance.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:12Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99993,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-26084","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-09-08","exploitedFirstSeen":"2021-09-08","ransomware":true,"evidence":[{"url":"https://www.lacework.com/blog/muhstik-takes-aim-at-confluence-cve-2021-26084/","date":"2021-09-08"},{"url":"https://cybersecurityworks.com/blog/vulnerabilities/cve-2021-26084-patch-the-confluence-servers-now.html","date":"2021-09-11"},{"url":"https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/","date":"2021-10-04"},{"url":"https://www.lacework.com/blog/spytech-necro-keksecs-latest-python-malware/","date":"2021-10-13"},{"url":"https://www.fortinet.com/blog/threat-research/recent-attack-uses-vulnerability-on-confluence-server","date":"2021-10-21"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.bleepingcomputer.com/news/security/new-cerber-ransomware-targets-confluence-and-gitlab-servers/","date":"2021-12-07"},{"url":"https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11"},{"url":"https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/#NightSky","date":"2021-12-11"},{"url":"https://unit42.paloaltonetworks.com/network-attacks-trends-august-october-2021/","date":"2021-12-21"}],"evidenceTotal":1026,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-917","name":"Improper Neutralization of Special Elements used in an Expression Language Statement"}],"references":[{"url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-67940","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-67940","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other Injection","mappingType":"primary_impact","evidence":[],"comment":"CVE-2021-26084 is a critical vulnerability affecting Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. This Object-Graph Navigation Language (OGNL) injection vulnerability enables attackers to execute arbitrary code on vulnerable Confluence instances","confidence":"high"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-26084 is a critical vulnerability affecting Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. This Object-Graph Navigation Language (OGNL) injection vulnerability enables attackers to execute arbitrary code on vulnerable Confluence instances","confidence":"high"}],"reports":[{"id":"SRC-622b5f77d51256e536ea","title":"Cadet Blizzard emerges as a novel and distinct Russian threat actor","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/","date":"2023-06-14","mentions":[{"quote":"Cadet Blizzard is also known for exploiting Confluence servers through the CVE-2021-26084 vulnerability, Exchange servers through multiple vulnerabilities including CVE-2022-41040 and ProxyShell, and likely commodity vulnerabilities in various open-source platforms such as content management systems.","start":9503,"end":9804},{"quote":"ngoing hands-on-keyboard attack via Impacket toolkit\n- Suspicious PowerShell command line\n- Suspicious WMI process creation\nMicrosoft Defender Vulnerability Management\nMicrosoft Defender Vulnerability Management surfaces devices that may be affected by the following vulnerabilities used in this threat:\n- CVE-2021-26084","start":20916,"end":21236}]},{"id":"SRC-db754fc6f8e3b44fee8e","title":"People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a","date":null,"mentions":[{"quote":"APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).","start":3713,"end":3947}]},{"id":"SRC-cb049733b1fc717427aa","title":"Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure","publisher":"cisa.gov","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf","date":null,"mentions":[{"quote":" CVE-2021-26084 (Atlassian Confluence Server and Data Center)","start":9765,"end":9827},{"quote":" NIST NVD: CVE-2021-26084","start":36881,"end":36907}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-12905","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-12905","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":50243,"url":"https://www.exploit-db.com/exploits/50243","title":"Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)","type":"webapps","platform":"java","date":"2021-09-01","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2021-09-01"},"pocGithub":{"count":34,"skipped":1,"earliest":"2021-08-31","earliestUrl":"https://github.com/crowsec-edtech/CVE-2021-26084","repos":[{"name":"hev0x/CVE-2021-26084_Confluence","url":"https://github.com/hev0x/CVE-2021-26084_Confluence","stars":316,"created":"2021-09-01"},{"name":"0xf4n9x/CVE-2021-26084","url":"https://github.com/0xf4n9x/CVE-2021-26084","stars":72,"created":"2021-09-01"},{"name":"alt3kx/CVE-2021-26084_PoC","url":"https://github.com/alt3kx/CVE-2021-26084_PoC","stars":53,"created":"2021-08-31"},{"name":"dinhbaouit/CVE-2021-26084","url":"https://github.com/dinhbaouit/CVE-2021-26084","stars":53,"created":"2021-09-01"},{"name":"1ZRR4H/CVE-2021-26084","url":"https://github.com/1ZRR4H/CVE-2021-26084","stars":29,"created":"2021-09-07"}]},"metasploit":[{"name":"Atlassian Confluence WebWork OGNL Injection","module":"exploit/multi/http/atlassian_confluence_webwork_ognl_injection","type":"exploit","disclosureDate":"2021-08-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_webwork_ognl_injection.rb"}],"nuclei":[{"id":"CVE-2021-26084","name":"Confluence Server - Remote Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-26084.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26084.yaml"}],"first":{"date":"2021-08-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_webwork_ognl_injection.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Java Payload Strings","id":"583aa0a2-30b1-4d62-8bf3-ab73689efe6c","level":"high","status":"test","path":"rules/web/webserver_generic/web_java_payload_in_access_logs.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_java_payload_in_access_logs.yml","techniques":["T1190"]},{"title":"Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt","id":"245f92e3-c4da-45f1-9070-bc552e06db11","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml","techniques":["T1190","T1059"]},{"title":"Potential CVE-2021-26084 Exploitation Attempt","id":"38825179-3c78-4fed-b222-2e2166b926b1","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1496"],"provenance":"source"}],"timeline":[{"date":"2021-08-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-08-31, Exploit-DB 2021-09-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_webwork_ognl_injection.rb","provenance":"source"},{"date":"2021-08-30","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26084","provenance":"source"},{"date":"2021-09-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.lacework.com/blog/muhstik-takes-aim-at-confluence-cve-2021-26084/","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-12905","provenance":"source"},{"date":"2023-06-14","kind":"report","label":"Named in microsoft.com: Cadet Blizzard emerges as a novel and distinct Russian threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":65},"priority":{"score":87.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1879 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 34 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}