60
CVE-2021-26084
KEV ransomware PoC —Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
CVSS 3.1
9.8 critical
EPSS
100%p100
Published
()
KEV added
AI analysis
CVE-2021-26084 is an OGNL injection vulnerability (CWE-917) in Atlassian Confluence Server and Data Center that may allow an unauthenticated attacker to execute arbitrary code. Any organization running Confluence Server or Data Center is potentially affected. It is significant because it is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, and EPSS assigns a 100.0% probability of exploitation within 30 days (100th percentile).
What to do: Apply updates to Confluence Server and Data Center per Atlassian's instructions, which is the required action in the CISA KEV listing. Prioritize remediation given confirmed in-the-wild exploitation and known ransomware use.
Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
CISA Known Exploited Vulnerability
- Affected
- Atlassian Confluence Server and Data Center
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Known
- Vendors
- atlassian
- Products
- confluence data center, confluence server
- Weakness
- CWE-917
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news20 stories
60
60
60
60
Network Security Trends: August
60
60
60
60
60
60
60
In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues
60
60
60
60
60
55% Actively Exploited Zero-Day Flaws In 2022 Are Variants Of Previous Bugs
60
60
60