CVE-2021-26084

Confirmed PUBLISHED

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to...

Atlassian · Confluence Server, Confluence Data Center

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

nuclei_scanner cisa ransomware metasploit malware

CVE Published: Aug 30, 2021
Exploitation Reported: Nov 03, 2021
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Atlassian	Confluence Server	unspecified to < 6.13.23	Affected
Atlassian	Confluence Server	6.14.0 to < unspecified	Affected
Atlassian	Confluence Server	unspecified to < 7.4.11	Affected
Atlassian	Confluence Server	7.5.0 to < unspecified	Affected
Atlassian	Confluence Server	unspecified to < 7.11.6	Affected
Atlassian	Confluence Server	7.12.0 to < unspecified	Affected
Atlassian	Confluence Server	unspecified to < 7.12.5	Affected
Atlassian	Confluence Data Center	unspecified to < 6.13.23	Affected
Atlassian	Confluence Data Center	6.14.0 to < unspecified	Affected
Atlassian	Confluence Data Center	unspecified to < 7.4.11	Affected
Atlassian	Confluence Data Center	7.5.0 to < unspecified	Affected
Atlassian	Confluence Data Center	unspecified to < 7.11.6	Affected
Atlassian	Confluence Data Center	7.12.0 to < unspecified	Affected
Atlassian	Confluence Data Center	unspecified to < 7.12.5	Affected

CVE References

jira.atlassian.com/browse/CONFSERVER-67940 jira.atlassian.com · CVE Record https://jira.atlassian.com/browse/CONFSERVER-67940
packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Name...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26084.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_webwork_ognl_injection.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Used in malware

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-08-31 16:33:32 UTC · GitHub

Weaknesses (CWE)

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_webwork_ognl_injection.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26084.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

ZZ-SOCMAP/CVE-2021-26084

github · Created 2022-01-13 06:29:51 UTC · 8 stars

POC of CVE-2021-26084, which is Atlassian Confluence Server OGNL(Object-Graph Navigation Language) Pre-Auth RCE Injection Vulneralibity.

lleavesl/CVE-2021-26084

github · Created 2021-10-26 06:01:38 UTC · 7 stars

CVE-2021-26084，Atlassian Confluence OGNL注入漏洞

orangmuda/CVE-2021-26084

github · Created 2021-10-06 23:24:24 UTC · 4 stars

CVE-2021-26084 - Confluence Server Webwork OGNL injection

ludy-dev/CVE-2021-26084_PoC

github · Created 2021-09-18 07:33:24 UTC · 3 stars

[CVE-2021-26084] Confluence pre-auth RCE test script

attacker-codeninja/CVE-2021-26084

github · Created 2021-09-09 09:29:24 UTC · 0 stars

Confluence OGNL injection

1ZRR4H/CVE-2021-26084

github · Created 2021-09-07 01:15:16 UTC · 30 stars

Atlassian Confluence CVE-2021-26084 one-liner mass checker

smadi0x86/CVE-2021-26084

github · Created 2021-09-05 09:27:55 UTC · 6 stars

Confluence server webwork OGNL injection

Loneyers/CVE-2021-26084

github · Created 2021-09-03 07:41:36 UTC · 3 stars

CVE-2021-26084 Confluence OGNL injection

taythebot/CVE-2021-26084

github · Created 2021-09-01 15:19:19 UTC · 8 stars

CVE-2021-26084 - Confluence Server Webwork OGNL injection (Pre-Auth RCE)

b1gw00d/CVE-2021-26084

github · Created 2021-09-01 14:16:29 UTC · 0 stars

批量检测

CrackerCat/CVE-2021-26084

github · Created 2021-09-01 13:20:13 UTC · 0 stars

Atlassian Confluence Pre-Auth RCE

Vulnmachines/Confluence_CVE-2021-26084

github · Created 2021-09-01 12:19:53 UTC · 9 stars

Remote Code Execution on Confluence Servers : CVE-2021-26084

0xf4n9x/CVE-2021-26084

github · Created 2021-09-01 09:50:26 UTC · 69 stars

CVE-2021-26084 Remote Code Execution on Confluence Servers

prettyrecon/CVE-2021-26084_Confluence

github · Created 2021-09-01 08:39:41 UTC · 1 stars

CVE-2021-26084 - Confluence Pre-Auth RCE OGNL injection 回显

hev0x/CVE-2021-26084_Confluence

github · Created 2021-09-01 07:15:17 UTC · 309 stars

Confluence Server Webwork OGNL injection

JKme/CVE-2021-26084

github · Created 2021-09-01 02:35:04 UTC · 5 stars

CVE-2021-26084 Remote Code Execution on Confluence Servers, reference: https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md

dinhbaouit/CVE-2021-26084

github · Created 2021-09-01 00:50:30 UTC · 54 stars

alt3kx/CVE-2021-26084_PoC

github · Created 2021-08-31 23:33:44 UTC · 54 stars

crowsec-edtech/CVE-2021-26084

github · Created 2021-08-31 16:33:32 UTC · 21 stars

CVE-2021-26084 - Confluence Pre-Auth RCE | OGNL injection

Confluence Server - Remote Code Execution

nuclei · Created Unknown

atlassian_confluence_webwork_ognl_injection

metasploit · Created Unknown

Metasploit module for CVE-2021-26084

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

First public exploitation report

Exploit observed in malware
31 Aug 2021 16:33 UTC almost 5 years ago

31 Aug 2021 16:33 UTC · almost 5 years ago

Public PoC available

Public proof-of-concept code published
30 Aug 2021 06:30 UTC almost 5 years ago

30 Aug 2021 06:30 UTC · almost 5 years ago

CVE published

Vulnerability disclosed publicly
25 Jan 2021 00:00 UTC over 5 years ago

25 Jan 2021 00:00 UTC · over 5 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-26084

{
  "cve_id": "CVE-2021-26084",
  "title": "In affected versions of Confluence Server and Data Center, an OGNL injection ...",
  "affected_vendor": "Atlassian",
  "affected_product": "Confluence Server, Confluence Data Center",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-26084

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API