Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Published: 2021-08-30
Score: 9.8 Critical
EPSS: 100.0% High
KEV: Yes
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 17 Dec 2025 16:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'rapid', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 17 Dec 2025 15:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'rapid', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 17 Dec 2025 10:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'rapid', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 17 Dec 2025 09:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'rapid', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 17 Dec 2025 06:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'rapid', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 22 Oct 2025 02:30:00 +0200


Tue, 21 Oct 2025 22:30:00 +0200


Tue, 21 Oct 2025 21:30:00 +0200


Wed, 30 Jul 2025 04:15:00 +0200

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'rapid', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 04 Feb 2025 16:15:00 +0100

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2021-11-03'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Subscriptions

Atlassian Confluence Data Center Confluence Server
cve-icon MITRE

Status: PUBLISHED

Assigner: atlassian

Published:

Updated: 2025-12-16T18:04:05.834Z

Reserved: 2021-01-25T00:00:00.000Z

Link: CVE-2021-26084

cve-icon Vulnrichment

Updated: 2024-08-03T20:19:19.592Z

cve-icon NVD

Status : Analyzed

Published: 2021-08-30T07:15:06.587

Modified: 2026-06-17T03:42:49.750

Link: CVE-2021-26084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-917

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')