CVE-2021-26085

What it actually does

This vulnerability is a pre-authentication authorization bypass in Atlassian Confluence Server's /s/ static-resource endpoint. A remote, unauthenticated attacker can craft requests to retrieve files or restricted resources that should not be accessible without authentication. The primary impact is confidentiality loss: exposed files may include application configuration, plugin metadata, deployment details, or other sensitive resources that can support follow-on attacks. The flaw does not directly provide code execution, data modification, or denial of service, but disclosed secrets or configuration details may enable credential theft, lateral movement, or chaining with other Confluence vulnerabilities.

Why it matters to the business

Exposed Confluence instances can leak sensitive internal knowledge-base content or server-side configuration information to unauthenticated internet attackers. Because this issue is in CISA KEV, has been observed exploited in the wild, is associated with ransomware activity, and has an extremely high EPSS likelihood, it should be treated as an urgent exposure even though the base CVSS score is moderate. Successful exploitation can lead to loss of confidential documentation, disclosure of infrastructure details, increased risk of account or database compromise if secrets are exposed, and easier targeting of the organization by ransomware or intrusion groups. CISA's remediation due date for known-exploited systems was 2022-04-18, so any remaining vulnerable deployments are significantly overdue for remediation.

How an attack unfolds

An attacker first identifies a publicly reachable Confluence Server instance and fingerprints its version or behavior. If the server is running an affected release, the attacker sends unauthenticated HTTP requests to the /s/ endpoint using crafted resource paths intended to bypass normal authorization checks. The server incorrectly serves resources that should be restricted, allowing the attacker to read files or application resources without logging in. The attacker then reviews the disclosed content for configuration details, internal paths, plugin versions, user or space metadata, credentials, tokens, or other sensitive information. In real-world intrusion activity, this type of access is commonly used for reconnaissance and may be chained with credential attacks, exploitation of separate Confluence flaws, webshell deployment through other vulnerabilities, or ransomware staging.

How to fix it

Upgrade Atlassian Confluence Server to a fixed version immediately. Affected versions are before 7.4.10 and versions 7.5.0 through before 7.12.3; upgrade to 7.4.10, 7.12.3, or a later supported release. Prefer upgrading to the latest supported Confluence version to receive all subsequent security fixes. If immediate upgrade is not possible, restrict network access to Confluence to trusted users through VPN, identity-aware proxy, WAF, or allowlists; block unauthenticated internet access to /s/ where feasible; and monitor aggressively for exploitation attempts. Because exploitation is known in the wild and associated with ransomware activity, rotate any secrets that may have been exposed by readable Confluence configuration files, including database credentials, API tokens, service account passwords, and integration keys. The package entries referencing MySQL fixed versions should not be used as the primary remediation for this Confluence vulnerability; validate the actual Atlassian Confluence application version and patch status.

How to confirm the fix worked

Confirm the installed Confluence Server version is 7.4.10, 7.12.3, or a later supported fixed release. Validate using the Confluence administration interface, application build information, package inventory, deployment manifests, or vendor-supported version checks. From an unauthenticated network location, verify that crafted requests to /s/ cannot retrieve restricted application files or configuration resources and return an appropriate 403, 404, or equivalent denial response. Review reverse proxy, WAF, load balancer, and Confluence access logs for historical requests to /s/ containing suspicious file names, path traversal-like patterns, WEB-INF references, configuration file names, or unusually high-volume enumeration. If prior exposure is suspected, perform incident response review and rotate potentially exposed credentials rather than relying only on patch confirmation.

Typical attack path

1. Scan the internet or target address ranges for exposed Atlassian Confluence Server instances.
2. Fingerprint Confluence version, headers, static resources, or page behavior to identify potentially affected releases.
3. Send unauthenticated crafted HTTP requests to the /s/ endpoint that attempt to retrieve restricted files or resources.
4. Analyze returned content for sensitive configuration data, application paths, plugin details, credentials, tokens, or internal documentation references.
5. Use the disclosed information to support follow-on attacks such as password spraying, credential reuse, exploitation of other Confluence vulnerabilities, or broader internal reconnaissance.
6. If additional access is obtained through chained techniques, stage persistence, exfiltrate data, or deploy ransomware tooling.

How to detect it

Review HTTP access logs from Confluence, reverse proxies, load balancers, WAFs, and CDN layers for unauthenticated requests to the /s/ endpoint that reference internal application paths, WEB-INF, configuration files, XML descriptors, properties files, or repeated probing of many resource paths. Prioritize requests returning HTTP 200 responses or unusually large byte counts, especially from unfamiliar external IPs, scanners, hosting providers, or Tor/VPN infrastructure. Examine Confluence application logs for abnormal static-resource handling errors, file-not-found bursts, or access to sensitive resource names. Correlate suspicious /s/ activity with subsequent authentication events, failed logins, new user creation, administrative changes, plugin installation, unexpected process execution, webshell artifacts, outbound connections, or ransomware staging behavior. Because this flaw is a file-read issue rather than direct code execution, absence of process-level indicators does not rule out compromise; focus on evidence of sensitive-file retrieval and follow-on use of exposed credentials or configuration data.

• GET /s/
• POST /s/
• /s/.*WEB-INF
• /s/.*WEB-INF/web.xml
• /s/.*confluence-init.properties
• /s/.*databaseSubsystemContext.xml
• /s/.*seraph-config.xml
• /s/.*osuser.xml
• /s/.*atlassian-user.xml
• /s/.*confluence.cfg.xml
• /s/.*\.properties
• /s/.*\.xml
• /s/.*\.jsp
• /s/.*%2e%2e
• /s/.*../
• /s/.*..%2f
• /s/.*%252e%252e
• /s/.*META-INF
• /s/.*applicationContext.xml
• /s/.*log4j.properties

What your security team should do

• Immediately identify all internet-facing and internally reachable Atlassian Confluence Server instances and verify whether any are older than 7.4.10 or in the 7.5.0-before-7.12.3 range.
• Patch or upgrade vulnerable Confluence deployments to 7.4.10, 7.12.3, or a later supported release as the highest priority; this issue is known exploited, ransomware-associated, and long overdue under CISA KEV timelines.
• Temporarily restrict Confluence access to trusted networks or authenticated access paths until patching is complete, especially for internet-facing systems.
• Hunt historical HTTP logs for suspicious unauthenticated /s/ endpoint requests and signs of file enumeration or configuration-file retrieval.
• If suspicious access is found, assume sensitive configuration may have been disclosed; rotate Confluence-related database passwords, API tokens, service account credentials, SSO secrets, and integration keys.
• Correlate any exploitation attempts with later authentication anomalies, new administrative users, unusual plugin uploads, webshell indicators, outbound connections, or ransomware precursor activity.
• Deploy or tune WAF and SIEM detections for suspicious /s/ requests referencing WEB-INF, configuration files, .properties files, XML descriptors, or traversal-like path patterns.
• Ensure Confluence is covered by vulnerability management, external attack surface monitoring, backup validation, and incident response playbooks due to its common use as a repository for sensitive operational documentation.