CVE-2021-26084

What it actually does

CVE-2021-26084 is an unauthenticated OGNL injection vulnerability in Atlassian Confluence Server and Confluence Data Center. A remote attacker can send a specially crafted HTTP request to a vulnerable Confluence endpoint and cause the application to evaluate attacker-controlled OGNL expressions. Because Confluence runs on the Java application server with operating-system permissions assigned to the Confluence service account, successful exploitation can lead to arbitrary command execution, file creation or modification, web shell deployment, credential theft, data access, and full compromise of the Confluence host.

Why it matters to the business

A successful attack can give an external attacker control of a Confluence server, allowing theft or destruction of internal documentation, credentials, source-code references, project plans, and other sensitive knowledge stored in or connected to Confluence. Because this vulnerability is unauthenticated, has a critical CVSS score, has extremely high EPSS likelihood, is listed in CISA KEV, and has been used in ransomware campaigns, exposed systems should be treated as high-priority incident-response targets rather than routine patching items. Compromise can also disrupt collaboration services, enable lateral movement into connected systems, and create regulatory or contractual exposure if sensitive data is accessed.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable Confluence Server or Data Center instance running an affected version. The attacker sends a crafted HTTP request to a vulnerable Confluence action endpoint containing malicious OGNL syntax. The vulnerable server evaluates the injected expression and executes attacker-supplied Java or operating-system commands under the Confluence service account. In real-world exploitation, attackers commonly use the initial command execution to download scripts or binaries, create web shells, run reconnaissance commands, install cryptocurrency miners, dump configuration files, steal credentials, add persistence, or deploy ransomware. Because exploitation requires no authentication and no user interaction, automated scanning and mass exploitation have been common since public disclosure.

How to fix it

Upgrade affected Confluence Server and Data Center deployments to a fixed version immediately. Fixed release lines are: 6.13.23 or later for the 6.13.x line; 7.4.11 or later for the 7.4.x line; 7.11.6 or later for the 7.11.x line; and 7.12.5 or later for the 7.12.x line. If possible, upgrade to the latest supported Confluence version rather than only the minimum fixed release. If immediate upgrade is not possible, remove public access to Confluence, restrict access through VPN or trusted networks only, apply vendor-recommended mitigations if still available for the deployed version, and consider temporarily shutting down exposed instances until patched. After patching, rotate credentials and secrets accessible to Confluence, including database credentials, application links, API tokens, service-account passwords, and any secrets stored in pages or attachments if compromise is suspected. Because this vulnerability is known exploited and associated with ransomware activity, patching alone is not sufficient for systems exposed before remediation; perform compromise assessment before returning systems to normal trust.

How to confirm the fix worked

Confirm the installed Confluence version is not in an affected range: versions before 6.13.23, 6.14.0 through before 7.4.11, 7.5.0 through before 7.11.6, and 7.12.0 through before 7.12.5 are vulnerable. Validate the running application version from the Confluence administration interface, package metadata, application files, or startup logs. Verify that public or untrusted network access is restricted where required. Review HTTP access logs to ensure requests to known vulnerable action endpoints are no longer succeeding with suspicious payloads. Use an authenticated vulnerability scanner or vendor-supported check to verify remediation. Where feasible, test in a controlled manner that known benign OGNL validation payloads are not evaluated. Also verify file integrity of the Confluence installation and home directories to ensure no unexpected JSP files, scripts, binaries, scheduled tasks, or service modifications remain after patching.

Typical attack path

1. Scan for exposed Atlassian Confluence Server or Data Center instances and identify likely vulnerable versions or responsive Confluence endpoints.
2. Send a crafted unauthenticated HTTP request containing OGNL injection payloads to a vulnerable Confluence action endpoint.
3. Trigger server-side evaluation of the OGNL expression and execute Java or operating-system commands as the Confluence service account.
4. Run discovery commands such as whoami, id, uname, hostname, ipconfig/ifconfig, or environment variable collection.
5. Download and execute second-stage payloads using tools such as curl, wget, PowerShell, certutil, or scripting interpreters.
6. Deploy persistence such as JSP web shells, scheduled tasks, cron jobs, modified startup scripts, or additional user accounts where permissions allow.
7. Access Confluence configuration, attachments, database connection settings, application data, and credentials available to the Confluence process.
8. Move laterally to connected infrastructure or deploy disruptive payloads, including ransomware, if broader access is obtained.

How to detect it

Investigate both exploitation attempts and successful post-exploitation activity. Review Confluence access logs, reverse proxy logs, WAF logs, load balancer logs, catalina logs, atlassian-confluence.log, operating-system process telemetry, EDR events, shell history, scheduled tasks, cron entries, and file modification timestamps. Look for unauthenticated requests to Confluence action endpoints containing OGNL metacharacters, Java class references, command execution strings, or download commands. Pay special attention to POST requests and unusual 200/302/500 responses around vulnerable endpoints. On the host, look for the Java Confluence process spawning shells or utilities such as sh, bash, cmd.exe, powershell.exe, curl, wget, certutil, python, perl, nc, ncat, chmod, or suspicious archive tools. Search for newly created or modified JSP files under the Confluence installation directory, web application directory, temporary directories, plugin directories, and Confluence home. Review outbound network connections from the Confluence host to unfamiliar IP addresses, especially immediately after suspicious HTTP requests. Because exploitation has been associated with ransomware and mass exploitation, also hunt for miners, web shells, privilege escalation tools, credential access, lateral movement, and unusual encryption or deletion activity. Absence of a single IOC does not rule out compromise; correlate web request timing with process creation, file writes, and outbound connections.

• POST /pages/createpage-entervariables.action
• GET /pages/createpage-entervariables.action
• POST /pages/doenterpagevariables.action
• GET /pages/doenterpagevariables.action
• /pages/createpage-entervariables.action
• /pages/doenterpagevariables.action
• @java.lang.Runtime@getRuntime
• java.lang.Runtime
• ProcessBuilder
• @ognl.OgnlContext@DEFAULT_MEMBER_ACCESS
• DEFAULT_MEMBER_ACCESS
• xwork.MethodAccessor.denyMethodExecution
• memberAccess
• getRuntime().exec
• %{
• ${
• curl
• wget
• chmod +x
• bash -c
• /bin/bash
• /bin/sh
• cmd.exe /c
• powershell.exe
• certutil.exe
• python -c
• perl -e
• nc -e
• ncat -e
• whoami
• uname -a
• /etc/passwd
• atlassian-confluence.log
• catalina.out
• .jsp
• confluence/pages/
• confluence/admin/
• confluence/plugins/
• Confluence process spawned shell
• java spawned bash
• java spawned sh
• java spawned cmd.exe
• java spawned powershell.exe

What your security team should do

• Treat any internet-exposed vulnerable Confluence instance as potentially compromised due to active exploitation, KEV listing, ransomware usage, and extremely high exploitation probability.
• Upgrade immediately to a fixed Confluence version or the latest supported release; do not rely solely on perimeter filtering for long-term protection.
• If the instance was exposed before patching, begin incident response: preserve logs, collect forensic images where appropriate, and hunt for web shells, suspicious child processes, and downloaded payloads.
• Restrict Confluence administrative and application access to trusted networks, VPN, or zero-trust access controls; remove direct public exposure where possible.
• Rotate Confluence database credentials, application-link secrets, API tokens, service-account passwords, and any other secrets accessible to the Confluence process if exploitation cannot be confidently ruled out.
• Search historical web, application, proxy, EDR, and operating-system logs for OGNL payloads, suspicious Confluence endpoint access, and Java spawning command interpreters or download utilities.
• Review Confluence installation and home directories for unauthorized JSP files, scripts, recently modified binaries, or unexpected plugins.
• Monitor for post-exploitation behavior such as cryptocurrency mining, outbound connections to unknown infrastructure, ransomware tooling, credential dumping, scheduled task creation, cron modifications, and lateral movement.
• Prioritize remediation ahead of normal patch cycles because CISA required remediation by 2021-11-17 for federal agencies and exploitation has been active in the wild for years.
• Ensure backups are current, offline or immutable, and restorable before and after remediation, especially because this vulnerability has been used in ransomware campaigns.