CVE-2021-26072

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 41.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-01 · updated 2026-06-17
Weakness: CWE-918

Description

The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

Affected products

Atlassian Confluence Data Center: before 5.8.6 — fixed in 5.8.6
Atlassian Confluence Data Center: before 5.8.6 — fixed in 5.8.6

How to fix

Upgrade to a fixed version: Atlassian Confluence Data Center 5.8.6; Atlassian Confluence Data Center 5.8.6. Check the vendor advisory for mitigations.

References

https://jira.atlassian.com/browse/CONFSERVER-61399
https://jira.atlassian.com/browse/CONFSERVER-61399

Get alerted when CVE-2021-26072 or the next vulnerability affects your stack