CVE-2021-26084 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection

Exploited in the wild Critical 9.8 Published 30 Aug 2021 Updated 16 Dec 2025

Unauthenticated attackers can execute arbitrary code on Confluence Server or Data Center instances via OGNL injection.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-26084?

CVE-2021-26084 is a critical code injection vulnerability in Atlassian Confluence Data Center, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Weakness: CWE-917

Which versions are affected by CVE-2021-26084?

It affects 2 products.

Products include Atlassian Confluence Data Center, Atlassian Confluence Server.

How do I fix CVE-2021-26084?

No fix has been published for CVE-2021-26084 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-26084 being exploited?

Yes. Attackers have exploited CVE-2021-26084 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 35 proofs of concept on GitHub.

Sources

Also known as GHSA-855c-xp53-5fp2.