CVE-2021-26084: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

CVE-2021-26084 is an Object-Graph Navigation Language (OGNL) injection vulnerability in Atlassian Confluence Server and Data Center. An unauthenticated attacker may be able to execute code on a vulnerable instance. CISA notes known ransomware use, so organizations running Confluence should treat this as high priority and confirm exact impact and fixed releases against the vendor advisory.

This guidance is for IT and security teams who need to inventory, detect, and remediate the issue without relying on unverified technical claims.

How it works

The weakness is classified as CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement. In products that evaluate OGNL expressions, user-controlled input that reaches an expression evaluator without proper neutralization can be interpreted as executable expression logic rather than inert data.

In this class of flaw, an attacker who can submit crafted input to an exposed Confluence endpoint may cause the server to evaluate malicious OGNL. Successful abuse can lead to arbitrary code execution in the context of the Confluence process. The CISA summary states that exploitation may be possible without authentication. Exact request paths, parameters, and preconditions are not repeated here; defenders must obtain those details only from the official Atlassian advisory and their own testing in a controlled environment.

Am I affected? How to find it in your systems

Confluence Server and Data Center typically run as on-premises or self-managed collaboration platforms, often behind reverse proxies or load balancers, and are commonly integrated with identity providers and file stores. Cloud-hosted Atlassian offerings are outside the scope of this CVE description unless the vendor advisory says otherwise.

• Inventory: Query CMDB, software asset tools, container/orchestrator inventories, and package or installer records for Confluence Server or Data Center. Check listening services and reverse-proxy configs that forward to Confluence HTTP/HTTPS ports.
• Version and edition: Record the exact Confluence version and whether the deployment is Server or Data Center. Compare against the fixed versions and any configuration notes in the vendor advisory—do not assume a version range from secondary sources.
• Exposure: Identify instances reachable from the internet or broad internal networks. Note any anonymous access, public spaces, or unauthenticated endpoints that the advisory associates with the issue.
• Telemetry: Review web access logs, WAF logs, and Confluence application logs for anomalous requests around expression-related or unusual parameter patterns, spikes in errors from the webwork/OGNL stack, or unexpected child processes spawned by the Confluence Java process. Correlate with EDR alerts for suspicious command execution by the Confluence service account. Absence of known indicators does not prove safety.

How to remediate

Patch first. Apply the updates Atlassian specifies for CVE-2021-26084, following the vendor’s installation and restart procedures. CISA’s required action is to apply updates per vendor instructions. After patching, verify the running version and re-test exposure.

• Confirm the advisory’s fixed builds and any mandatory configuration steps before declaring the change complete.
• Restrict network access to Confluence management and user interfaces to trusted networks and authenticated users where business needs allow.
• Run Confluence under a least-privilege service account, keep the host and Java runtime patched, and ensure outbound egress from the Confluence host is limited to required destinations.
• Maintain current backups of Confluence data and home directories, and validate restore procedures so ransomware or destructive follow-on activity can be recovered from.

If you can't patch immediately

Use compensating controls only as a bridge until the vendor update is applied.

• Segmentation: Place Confluence behind VPN or zero-trust access; block direct internet exposure at the firewall or load balancer.
• Virtual patching / WAF: Deploy vendor- or community-informed WAF rules that target the request patterns described in the official advisory; tune to reduce false positives and log all matches.
• Feature and access reduction: Disable anonymous access and unused apps/plugins; limit accounts that can reach administrative functions.
• Monitoring: Heighten alerting on Confluence process trees, new outbound connections, web shells or unexpected files under the Confluence install and temp directories, and authentication anomalies. Retain logs for incident response.
• Revisit the advisory frequently for any temporary mitigations Atlassian documents, and schedule the official patch without delay.

If your data may have been exposed

Actively exploited vulnerabilities with known ransomware use can lead to full compromise of the Confluence host, theft of content and credentials, and lateral movement. If you suspect exploitation, isolate affected systems, preserve logs and disk evidence, rotate secrets that Confluence could access, and follow your incident response plan, including notification obligations.

You can run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in public breach corpora, then enforce password resets and MFA where relevant.