CVE-2021-26085VulnerabilityPublished 03/28/2022Updated 10/24/2026
CVE-2021-26085: Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Affects Atlassian Confluence ServerSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 03/28/2022
- KEV deadline
- 04/18/2022
- Ransomware
- Used in ransomware campaigns
- EPSS
- 99.9% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2021-26085 is a high-severity vulnerability in Atlassian Confluence Server that allows remote attackers to read arbitrary files without authentication via the /s/ endpoint. This pre-authorization arbitrary file read flaw enables attackers to access restricted resources. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.