CVE-2021-26084 Explained: Confluence Server OGNL Injection and Mass Exploitation

Atlassian Confluence uses OGNL as its expression language for rendering dynamic web content. The vulnerability exists in certain Confluence endpoints that process user-supplied query parameters without sufficient sanitization before passing them through the OGNL evaluation engine.

In affected versions, specific WebWork actions in Confluence allow unauthenticated HTTP requests to supply OGNL expressions directly in query parameters. Because the expressions are evaluated server-side in the context of the Confluence application, an attacker can break out of the template context and execute arbitrary Java code — including spawning OS processes.

On some configurations, exploitation requires no authentication whatsoever. On others, a valid Confluence account with no special permissions is sufficient. Atlassian's advisory initially framed authentication as required, then clarified that unauthenticated exploitation was possible on default-configured instances — significantly expanding the risk surface.

Affected versions include Confluence Server and Data Center before 6.13.23, before 7.4.11 (LTS), before 7.11.6, before 7.12.5, and before 7.13.0. Confluence Cloud instances were not affected.

The exploitation timeline for CVE-2021-26084 was among the fastest observed for any enterprise vulnerability in 2021. Atlassian published the advisory on August 25. A proof-of-concept exploit appeared publicly on September 1. By September 2, CISA issued Advisory AA21-259A citing active exploitation at mass scale.

Threat actors who rapidly adopted CVE-2021-26084 included cryptocurrency mining groups deploying XMRig, multiple ransomware affiliates using the access for initial foothold and lateral movement, and nation-state groups — including actors attributed to Chinese cyber operations — conducting espionage-focused intrusions.

The rapid weaponization highlighted a persistent gap: organizations often treat collaboration tools like Confluence as lower-risk than perimeter infrastructure, resulting in delayed patching and less rigorous network segmentation around these systems. Confluence, however, frequently has privileged access to internal wikis, credentials, and network documentation that makes it a high-value target for both financially motivated and nation-state actors.

Atlassian released fixed versions on August 25, 2021. All Confluence Server and Data Center deployments must be updated to a patched version. There is no workaround that fully mitigates the vulnerability short of upgrading.

CVE-2021-26084 followed the now-familiar pattern of critical enterprise software vulnerabilities: public disclosure, immediate weaponization, mass exploitation, emergency CISA advisory — all within a week. The window between patch availability and active exploitation is not measured in weeks anymore. It is measured in hours.

Confluence is a high-value target precisely because of what it contains: architecture diagrams, runbooks, credential documentation, and internal network maps. An attacker who establishes a foothold on Confluence gains intelligence that accelerates every subsequent phase of an intrusion.

Patch immediately. Treat any delayed patching window as an assumed breach scenario. And audit what credentials and sensitive information live in your Confluence instance — because if an attacker gets in, they will read it before you change it.