What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

Active Exploitation of Critical Confluence Vulnerability

September 3, 2021 | 2 MINS READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT

eSentire has observed the active exploitation of a recently released critical vulnerability in the Atlassian Confluence platform. CVE-2021-26084 (CVSS: 9.8) was publicly announced on August 25th, 2021. The vulnerability is tracked as a Confluence Server Webwork OGNL injection vulnerability; exploitation allows an adversary to bypass authentication and perform remote code execution on vulnerable devices. CVE-2021-26084 impacts both Confluence Servers and Confluence Data Centers.

eSentire can confirm that exploitation has been ongoing since at least September 1st, 2021. Organizations that have yet to apply the relevant security patches are recommended to do so immediately, as exploitation is ongoing.

What we’re doing about it

What you should do about it

Additional information

Technical details for CVE-2021-26084 and Proof-of-Concept exploit code were publicly released on August 31st. The release of these details significantly reduces the barriers of exploitation for threat actors. Widespread scanning for vulnerable devices has been reported. It is likely that multiple threat actor groups are actively attempting to exploit CVE-2021-26084 for a variety of malicious purposes.

eSentire has observed multiple instances of exploitation. In one case, a cryptocurrency miner was deployed after initial access was gained via exploitation of CVE-2021-26084. In a separate instance observed by eSentire, the adversary attempted to download additional malicious content. The download was blocked by eSentire MDR for Endpoint. Currently, it is unclear what the adversary’s end goal was. This vulnerability may be exploited for a wide variety of malicious purposes ranging from information theft to the deployment of ransomware.

The following table shows both fixed and vulnerable versions of Confluence Servers and Data Centers according to Confluence. It should be noted that Confluence Cloud customers are not affected by CVE-2021-26084.

Fixed Versions:

Impacted Versions

6.13.23

All 4.x.x versions

7.4.11

All 5.x.x versions

7.11.6

All 6.0.x versions

7.12.5

All 6.1.x versions

7.13.0

All 6.2.x versions

All 6.3.x versions

All 6.4.x versions

All 6.5.x versions

All 6.6.x versions

All 6.7.x versions

All 6.8.x versions

All 6.9.x versions

All 6.10.x versions

All 6.11.x versions

All 6.12.x versions

All 6.13.x versions before 6.13.23

All 6.14.x versions

All 6.15.x versions

All 7.0.x versions

All 7.1.x versions

All 7.2.x versions

All 7.3.x versions

All 7.4.x versions before 7.4.11

All 7.5.x versions

All 7.6.x versions

All 7.7.x versions

All 7.8.x versions

All 7.9.x versions

All 7.10.x versions

All 7.11.x versions before 7.11.6

All 7.12.x versions before 7.12.5

All 4.x.x versions

All 5.x.x versions

All 6.0.x versions

All 6.1.x versions

All 6.2.x versions

All 6.3.x versions

All 6.4.x versions

All 6.5.x versions

References:

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-26084
[2] https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
[3] https://www.cyber.gov.au/acsc/view-all-content/alerts/remote-code-execution-vulnerability-present-certain-versions-atlassian-confluence

View Most Recent Advisories