CVE-2021-26085: Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability

Medium severity, CVSS 5.3. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 99.9% chance of exploitation in the next 30 days.

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

Affected products

• Atlassian Confluence Data Center: before 7.4.10 (fixed in 7.4.10); from 7.5.0, before 7.12.3 (fixed in 7.12.3)
• Atlassian Confluence Server: before 7.4.10 (fixed in 7.4.10); from 7.5.0, before 7.12.3 (fixed in 7.12.3)

Published 2021-08-03. Last modified 2026-06-17.