CVE-2021-26084

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 37 exploits · weaponized

Likely / severe?

100.0% (100th) EPSS

CVSS 7.5 · high

Is it mine?

30 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

added 2021-11-03remediate by 2021-11-17

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-26

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-917USprimaryCWE-74US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (37)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/atlassian_confluence_webwork_ognl_injectionAtlassian Confluence WebWork OGNL Injectionweaponized · metasploit
EDB-50243Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)PoC · exploit_db
0xf4n9x/CVE-2021-26084CVE-2021-26084 Remote Code Execution on Confluence ServersPoC · poc_in_github
1ZRR4H/CVE-2021-26084Atlassian Confluence CVE-2021-26084 one-liner mass checkerPoC · poc_in_github
30579096/Confluence-CVE-2021-26084OGNL Injection in Confluence server version < 7.12.5PoC · poc_in_github
BBD-YZZ/Confluence-RCEconfluence rce (CVE-2021-26084, CVE-2022-26134, CVE-2023-22527)PoC · poc_in_github

affected products (30)

Products and version ranges known to be affected.

Atlassian Confluence Data Center6.14.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Center7.12.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Center7.5.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Centerunspecified → 6.13.23enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.11.6enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.12.5enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.4.11enisa_euvdEU
Atlassian Confluence Server6.14.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Server7.12.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Server7.5.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Serverunspecified → 6.13.23enisa_euvdEU
Atlassian Confluence Serverunspecified → 7.11.6enisa_euvdEU
Atlassian Confluence Serverunspecified → 7.12.5enisa_euvdEU
Atlassian Confluence Serverunspecified → 7.4.11enisa_euvdEU
Atlassian Confluence Server≤ 6.13.23fstec_bduRU
Atlassian Confluence Server6.14.0 → 7.4.11fstec_bduRU
Atlassian Confluence Server7.12.0 → 7.12.5fstec_bduRU
Atlassian Confluence Server7.5.0 → 7.11.6fstec_bduRU
Atlassian Jira Data Center≤ 6.13.23fstec_bduRU
Atlassian Jira Data Center6.14.0 → 7.4.11fstec_bduRU

showing 20 of 30

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2021-08-30modified 2026-06-17

related (254)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-41901US	—OT critical	0.43% (37th)	Exploit	2026-05-12
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mech…
CVE-2026-40478US	—OT critical	1.10% (65th)	—	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression…
CVE-2026-40477US	—OT critical	0.85% (58th)	Exploit	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression exec…
CVE-2022-26134US	critical9.8OT critical	100.0% (100th)	KEV	2022-06-03
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu…
CVE-2022-22963US	critical9.8OT critical	99.9% (100th)	KEV	2022-04-01
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a r…

+249 more

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan