CVE-2021-26085
Published 2021-08-03 · Updated 2026-06-17 · Source security@atlassian.com
Summary
CVE-2021-26085 is a medium-severity (CVSS 5.3) vulnerability in Atlassian Confluence Server. CISA added it to the Known Exploited Vulnerabilities catalog on March 28, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 18, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Atlassian has 14 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.
All 14 known-exploited Atlassian vulnerabilities →Description
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Atlassian — Confluence Server
Name: Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Date added: 2022-03-28 · Due: 2022-04-18
Required action: Apply updates per vendor instructions.
References
- http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html
- https://jira.atlassian.com/browse/CONFSERVER-67893
- http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html
- https://jira.atlassian.com/browse/CONFSERVER-67893
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26085