CVE-2021-26084 Atlassian Confluence Server And Data Center

Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.

CVSS: not scored

CWE-917

On CISA’s exploited list

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Added: 2021-11-03
Federal patch deadline: 2021-11-17
Ransomware use: known

Actors known to use it (MITRE ATT&CK)

Ember BearRussia · UNC2589, Bleeding Bear, DEV-0586 · 39 techniques

NVD CVE.org All exploited vulnerabilities