TI-2021-08037 Aliases CVE-2021-26085 GHSA-8mjc-qhq2-3xm8

Affected versions of Atlassian Confluence Server allow remote attackers to view…

HIGH 81Exploited in the wildCWE-425Published 2021-08-03 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-425.

Summary

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

Why it matters now

Exploitation Active In CISA KEV since 2022-03-28CISA due date 2022-04-18Known ransomware use

EPSS 0.99937 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Confluence Server (Atlassian): 7.4.10, 7.12.3Confluence Data Center (Atlassian): 7.4.10, 7.12.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Confluence Server	before 7.4.10; 7.5.0 and later; before 7.12.3	7.4.10, 7.12.3	Patch available	CNA
Atlassian	Confluence Data Center	before 7.4.10; 7.5.0 and later; before 7.12.3	7.4.10, 7.12.3	Patch available	CNA

Confluence Server VendorAtlassian Affected before 7.4.10; 7.5.0 and later; before 7.12.3 Fixed in 7.4.10, 7.12.3 Patch available CNA
Confluence Data Center VendorAtlassian Affected before 7.4.10; 7.5.0 and later; before 7.12.3 Fixed in 7.4.10, 7.12.3 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:confluence_data_center::::::::	before 7.4.10; 7.5.0 to before 7.12.3	Vulnerable	Atlassian
cpe:2.3:a:atlassian:confluence_server::::::::	before 7.4.10; 7.5.0 to before 7.12.3	Vulnerable	Atlassian

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions before 7.4.10; 7.5.0 to before 7.12.3 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions before 7.4.10; 7.5.0 to before 7.12.3 Vulnerable ·Atlassian

Remediation

Fix · CNA Confluence Server (Atlassian) Fixed in 7.4.10, 7.12.3
Fix · CNA Confluence Data Center (Atlassian) Fixed in 7.4.10, 7.12.3

Timeline

2022-03-28 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2021-26085
2026-10-03 Alias added: GHSA-8mjc-qhq2-3xm8

References

Exploit 1

http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html

Advisory 1

https://jira.atlassian.com/browse/CONFSERVER-67893

TI-2023-08765 Injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2023-08757 Improper input validation in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2022-09596 Expression language injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2021-08036 Expression language injection in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
TI-2023-08759 Incorrect authorization in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences