Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Confluence Server | unspecified – < 6.13.23, 6.14.0 – < unspecified, unspecified – < 7.4.11, 7.5.0 – < unspecified, unspecified – < 7.11.6, 7.12.0 – < unspecified, unspecified – < 7.12.5 | 6.13.23 |
| Atlassian | Confluence Data Center | unspecified – < 6.13.23, 6.14.0 – < unspecified, unspecified – < 7.4.11, 7.5.0 – < unspecified, unspecified – < 7.11.6, 7.12.0 – < unspecified, unspecified – < 7.12.5 | 6.13.23 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Atlassian Confluence WebWork OGNL Injection
exploit/multi/http/atlassian_confluence_webwork_ognl_injection
Exploit-DB 1
- Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated) EDB-50243 · webapps · Sep 1, 2021
GitHub 35 repositories · most starred shown
-
hev0x/CVE-2021-26084_Confluence ★ 314 · Sep 1, 2021
Confluence Server Webwork OGNL injection
-
0xf4n9x/CVE-2021-26084 ★ 73 · Sep 1, 2021
CVE-2021-26084 Remote Code Execution on Confluence Servers
-
alt3kx/CVE-2021-26084_PoC ★ 54 · Aug 31, 2021
-
dinhbaouit/CVE-2021-26084 ★ 53 · Sep 1, 2021
-
1ZRR4H/CVE-2021-26084 ★ 29 · Sep 7, 2021
Atlassian Confluence CVE-2021-26084 one-liner mass checker
-
crowsec-edtech/CVE-2021-26084 ★ 21 · Aug 31, 2021
CVE-2021-26084 - Confluence Pre-Auth RCE | OGNL injection
-
ZZ-SOCMAP/CVE-2021-26084 ★ 9 · Jan 13, 2022
POC of CVE-2021-26084, which is Atlassian Confluence Server OGNL(Object-Graph Navigation Language) Pre-Auth RCE Injection Vulneralibity.
-
taythebot/CVE-2021-26084 ★ 8 · Sep 1, 2021
CVE-2021-26084 - Confluence Server Webwork OGNL injection (Pre-Auth RCE)
-
Vulnmachines/Confluence_CVE-2021-26084 ★ 8 · Sep 1, 2021
Remote Code Execution on Confluence Servers : CVE-2021-26084
-
lleavesl/CVE-2021-26084 ★ 7 · Oct 26, 2021
CVE-2021-26084，Atlassian Confluence OGNL注入漏洞
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Confluence Server - Remote Code Execution http/cves/2021/CVE-2021-26084.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.