CVE-2021-26085

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-26085

Atlassian · Confluence Server · Added 2022-03-28 · Published 2021-08-03

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityAtlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability

VendorAtlassian

ProductConfluence Server

Date added2022-03-28

Due date2022-04-18

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

Descriptions

KEV: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-20 08:03 UTC

Wall time0.3s

Searches4

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2021-26085
https://github.com/ColdFusionX/CVE-2021-26085
https://threatprotect.qualys.com/2021/10/11/atlassian-confluence-server-pre-authorization-arbitrary-file-read-vulnerability-cve-2021-26085/
https://jira.atlassian.com/browse/CONFSERVER-67893
https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html

Hunting hypothesis agent

Monitor for unauthenticated HTTP GET requests to Confluence Server /s/ endpoint with path traversal sequences exploiting the pre-authorization arbitrary file read vulnerability.

Research details

Component/s/ endpoint

PreconditionsNetwork reachability to the Confluence Server HTTP/HTTPS interface (typically TCP port 8090 or 443); no authentication required; target must be running a vulnerable Confluence Server version (before 7.4.10, or 7.5.0 through 7.12.2); the /s/ endpoint must be accessible; exploitation uses crafted HTTP GET requests with path traversal sequences (";/") to bypass access controls agent

Deliveryhttp_request

Public PoCyes

PoC URLs https://github.com/ColdFusionX/CVE-2021-26085
https://www.exploit-db.com/exploits/50377 Third-party repos; verify before use.

Advisoryhttps://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html

Exploit notesCVSS base score: NVD data unavailable (null) | Exploitation requires crafting HTTP GET requests with ";/" path traversal sequences appended to the /s/ endpoint URL | No authentication required | Public PoC and exploit-db entry available, making exploitation straightforward for attackers | Affected versions: before 7.4.10 and 7.5.0 to 7.12.2

SummaryAtlassian Confluence Server contains a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. An unauthenticated remote attacker can read arbitrary files (e.g., WEB-INF/web.xml, configuration files, passwords) by sending crafted HTTP GET requests with path traversal sequences (";/") appended to the /s/ endpoint URL. Affects Confluence Server versions before 7.4.10 and 7.5.0 through 7.12.2. Public PoC and exploit-db entries exist.

Tia coverage

First reported2026-10-06

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

atlassian-bamboo-cve-2026-21589-critical-path-traversal-cvss-9-3

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.