Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability (CVE-2021-26085) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAtlassian Confluence Server and Data Center versions prior to 7.4.10, and versions from 7.5.0 prior to 7.12.3
Unauthenticated remote attackers can bypass authorization checks via the '/s/' endpoint to view restricted resources and sensitive internal files
Immediately upgrade affected instances to official patched versions (7.4.10, 7.12.3, or later), or restrict suspicious requests to the '/s/' endpoint using a WAF or reverse proxy
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Atlassian recommends upgrading affected Confluence instances to the designated Long Term Support (LTS) release or newer patched versions (7.4.10+, 7.12.3+).
Example upgrade commands for Linux environments:
# 1. Stop the Confluence service
sudo systemctl stop confluence
# 2. Backup Confluence Home and Installation directories
tar -czvf confluence_home_backup.tar.gz /var/atlassian/application-data/confluence
tar -czvf confluence_install_backup.tar.gz /opt/atlassian/confluence
# 3. Download and run the patched installer (e.g., version 7.12.3)
wget https://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-7.12.3-x64.bin
chmod +x atlassian-confluence-7.12.3-x64.bin
sudo ./atlassian-confluence-7.12.3-x64.bin2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, deploy a reverse proxy (e.g., Nginx) or Web Application Firewall (WAF) rule to block unauthorized or anomalous requests targeting the /s/ endpoint.
Example Nginx configuration to block directory traversal and sensitive path access:
# Add inside the Confluence server block
server {
listen 80;
server_name confluence.local;
location ~* ^/s/(.*)$ {
# Block requests containing directory traversal or sensitive directories
if ($request_uri ~* '(\.\.|WEB-INF|META-INF)') {
return 403;
}
proxy_pass http://127.0.0.1:8090;
include proxy_params;
}
}3. Log Audit & IoC Verification Commands
Inspect Confluence access logs to identify potential exploitation attempts targeting the /s/ endpoint.
# Search for successful HTTP 200 responses on the /s/ endpoint
grep -E '/s/.*HTTP' /var/atlassian/application-data/confluence/logs/atlassian-confluence-access.log* | grep ' 200 '
# Scan for suspicious patterns such as WEB-INF, META-INF, or path traversal in the /s/ endpoint
grep -Ei '/s/.*(WEB-INF|META-INF|\.\.)' /var/atlassian/application-data/confluence/logs/atlassian-confluence-access.log*Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-26085) is a pre-authorization arbitrary file read vulnerability in Atlassian Confluence Server and Data Center, specifically residing within the /s/ static resource serving endpoint. In Confluence's architecture, the /s/ endpoint is designed to serve cached static assets such as stylesheets, images, and JavaScript files to optimize performance. However, a flaw in the request handling logic fails to enforce proper access control and path validation (CWE-425), allowing unauthenticated remote attackers to bypass authorization checks and access restricted internal resources.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted HTTP GET request targeting the /s/ endpoint without requiring any authentication credentials. The vulnerable Confluence instance processes the request and, due to the lack of strict path and permission validation, retrieves and returns the contents of restricted internal files via the application's resource loader. Publicly available exploits demonstrate that this can be leveraged to read sensitive configuration files, class files, and other application metadata.
3. Infrastructure & Business Impact
This vulnerability is highly critical and is actively exploited in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 0.9994, it is subject to widespread automated scanning and opportunistic exploitation. If an attacker successfully retrieves sensitive configuration files (such as confluence.cfg.xml), they can extract database credentials, encryption keys, and local directory structures, potentially leading to database compromise, lateral movement, and severe business disruption.
Official Vendor Advisories & References
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Frequently Asked SecOps Questions (CVE-2021-26085)
FAQQ1. How critical is CVE-2021-26085 and is it actively exploited in the wild?
CVE-2021-26085 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-26085?
Primary impacted vendors include atlassian across confluence_server, confluence_data_center. Scope summary: Atlassian Confluence Server and Data Center: - Versions before 7.4.10 - Versions from 7.5.0 before 7.12.3
Q3. What temporary mitigations or workarounds exist for CVE-2021-26085 before patching?
[Mitigation] Immediately upgrade affected instances to official patched versions (7.4.10, 7.12.3, or later), or restrict suspicious requests to the '/s/' endpoint using a WAF or reverse proxy Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-26085
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (atlassian)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.