Vulnerabilities/Atlassian/CVE-2021-26084

CVE-2021-26084: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 3 Nov 2021

Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.

Recommended action

Apply updates per vendor instructions.

CISA due date 17 Nov 2021 · CWE-917

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
Confluence Serverbefore 6.13.23Unknown
Confluence Server6.14.0Unknown
Confluence Serverbefore 7.4.11Unknown
Confluence Server7.5.0Unknown
Confluence Serverbefore 7.11.6Unknown
Show 9 more rows
Confluence Server7.12.0Unknown
Confluence Serverbefore 7.12.5Unknown
Confluence Data Centerbefore 6.13.23Unknown
Confluence Data Center6.14.0Unknown
Confluence Data Centerbefore 7.4.11Unknown
Confluence Data Center7.5.0Unknown
Confluence Data Centerbefore 7.11.6Unknown
Confluence Data Center7.12.0Unknown
Confluence Data Centerbefore 7.12.5Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 3 Nov 2021 · Added to CISA KEV
  • 17 Nov 2021 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.