CVE-2024-21683: Atlassian Confluence Data Center and Server code injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS score of 8.8 and very high EPSS probability indicate a severe, likely exploitable vulnerability, though it requires authentication.

What it is

Confluence Data Center and Server contain a code injection flaw introduced in version 5.2 that allows an authenticated attacker to execute arbitrary code. The vulnerability has a CVSS score of 8.8 and requires no user interaction, making it a serious risk for exposed instances.

Impact

An authenticated attacker can execute arbitrary code with high impact to confidentiality, integrity, and availability of the Confluence instance. This could lead to full compromise of the application and its data.

Attack surface

The flaw is reachable over the network (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) but no user interaction (UI:N). An attacker must have a valid account on the Confluence instance.

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS indicates a very high probability of exploitation (0.88267, 99.76th percentile). No public exploit references are provided in the record.

What to do

• Upgrade Confluence Data Center and Server to the latest version or a specified supported fixed version as per Atlassian's advisory.
• If immediate patching is not possible, restrict network access to Confluence instances to trusted users only.
• Enforce strong authentication and least privilege for Confluence accounts to limit the impact of an authenticated attack.
• Monitor Atlassian's release notes and security advisories for further updates.

Detection

• Monitor Confluence application logs for unexpected code execution or suspicious administrative actions.
• Use network detection to identify unusual outbound connections from Confluence servers that could indicate command and control or data exfiltration.
• Audit user accounts for unauthorized privilege escalation or creation of new administrative users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.