Uncontrolled search path in Atlassian Confluence Server
Priority LOW 36CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-427.
Summary
Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Fixed Confluence Server (Atlassian): 7.4.10, 7.12.3Confluence Data Center (Atlassian): 7.4.10, 7.12.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Atlassian | Confluence Server | before 7.4.10; 7.5.0 and later; before 7.12.3 | 7.4.10, 7.12.3 | Patch available | CNA |
| Atlassian | Confluence Data Center | before 7.4.10; 7.5.0 and later; before 7.12.3 | 7.4.10, 7.12.3 | Patch available | CNA |
- Confluence Server VendorAtlassian Affected before 7.4.10; 7.5.0 and later; before 7.12.3 Fixed in 7.4.10, 7.12.3 Patch available CNA
- Confluence Data Center VendorAtlassian Affected before 7.4.10; 7.5.0 and later; before 7.12.3 Fixed in 7.4.10, 7.12.3 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* | before 7.4.10; 7.5.0 to before 7.12.3 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* | before 7.4.10; 7.5.0 to before 7.12.3 | Vulnerable | Atlassian |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions before 7.4.10; 7.5.0 to before 7.12.3 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions before 7.4.10; 7.5.0 to before 7.12.3 Vulnerable ·Atlassian
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Confluence Server (Atlassian) Fixed in 7.4.10, 7.12.3
- Fix · CNA Confluence Data Center (Atlassian) Fixed in 7.4.10, 7.12.3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43940
- 2026-10-03 Alias added: GHSA-fv2j-f74f-8cgr
References
More Atlassian Confluence Data Center vulnerabilities
- TI-2023-08765 Injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
- TI-2023-08757 Improper input validation in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
- TI-2022-09596 Expression language injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
- TI-2021-08036 Expression language injection in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
- TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
- TI-2023-08759 Incorrect authorization in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-43940 · CVE Program
- CVE-2021-43940 · NVD
- FIRST EPSS
- GHSA-fv2j-f74f-8cgr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences