Is CVE-2021-26085 (Atlassian Confluence Server Pre-Authorization Arbitrary File Read) being exploited in the wild?

How this vulnerability is being treated as active exploitation

CVE-2021-26085 is not just a disclosed flaw, it is one that CISA has already placed in the Known Exploited Vulnerabilities catalogue, which is a strong operational signal that defenders should treat it as actively abused. For vulnerability teams, that changes the question from “is there a patch?” to “is this internet-facing Confluence instance already exposed, and what evidence do we have that it was reached?”

Because the issue is a pre-authorization file-read path in Confluence Server, the first practical concern is whether unauthenticated requests can reach the vulnerable endpoint at all. If the product is reachable, the exposure is immediate enough that KEV-driven triage should take priority over ordinary backlog sequencing. CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm the active-exploitation status and the required response posture.

The right way to think about this class of issue is that it bypasses the normal trust boundary before authorization happens. That means defenders should not assume that “restricted resources” stayed restricted just because the application normally enforces access controls after login. The relevant control failure is that the request path itself can be abused before the application reaches those checks.

What exposure to check first on Confluence Server

Start with inventory, internet exposure, and version ownership. If you do not know where Confluence Server is deployed, or which instances are publicly reachable, you do not yet know your actual exposure surface. The minimum useful step is to identify every instance, confirm whether it is Server rather than Cloud, and verify whether the vulnerable endpoint is reachable from untrusted networks.

Then look for business impact based on the data Confluence holds. Many organisations store internal procedures, architecture diagrams, incident notes, secrets references, support runbooks, and integration details in Confluence. A file-read issue against that content can therefore become a disclosure event even when the server was not originally intended to be internet-facing. Atlassian Cloud Security Guide is useful background for the broader Atlassian security surface, including permissions and administrative controls around Confluence content.

For triage, treat any instance with externally reachable Confluence traffic as a priority candidate for immediate containment review. If the environment cannot prove that the vulnerable path was unreachable, assume exposure until the advisory and the CISA catalogue are both reconciled against the actual deployment.

When a live exploitation bulletin is paired with a file-read flaw, the most important factual question is not whether an attacker succeeded everywhere, but whether your instance was available to the same attack path. That is the practical boundary that determines whether you need incident response, not only patch management.

What to do if patching or shutdown must wait

If you cannot patch immediately, reduce reachability first. Put the application behind network restrictions, remove unnecessary public access, and limit access to the smallest set of users and admin paths that the business can tolerate. If the vulnerable endpoint can no longer be reached from the internet, the attacker’s cheapest path is removed while you work on the permanent fix.

You should also inspect reverse proxy, WAF, and log telemetry for requests that target Confluence file-read style paths, unusual bursts of requests to the /s/ endpoint, and any follow-on access to content that should not have been retrievable without authentication. This is especially important when patch timing is delayed, because delay increases the window in which commodity scanning and opportunistic exploitation can occur.

If sensitive documents may have been exposed, treat the issue as a possible disclosure event, not merely an application defect. That means checking whether the content held credentials, session references, internal links, API details, or other material that should be rotated or invalidated after exposure. Vulnerability Management Guide is a good reference point for prioritisation, exception handling, and post-remediation verification.

Risk and Threat Considerations

This vulnerability matters because unauthenticated file read can convert a simple web exposure into a broader confidentiality incident. In a real environment, that often means reconnaissance, theft of internal documentation, and discovery of credentials or integration details that help an attacker move to other systems.

Failure mechanism: The attacker abuses a pre-authorization request path to retrieve restricted content before normal login-based checks are applied, then uses the disclosed material to expand access or persistence.

Impact: The likely consequences are data exposure, credential theft, follow-on compromise, and in KEV-listed cases, a materially higher chance that the weakness is already being scanned and exploited at scale.

Practitioner Guidance

What to prioritise: Prioritise externally reachable Confluence Server instances first, then any instance that stores sensitive internal documentation or operational secrets. If you cannot quickly prove low exposure, treat it as high priority even if patching is already scheduled.

What to verify: Verify whether any requested content was accessible without authentication, whether access logs show suspicious requests to the affected path, and whether documents in Confluence contained information that would warrant credential rotation or broader compromise assessment.

Decision rule: If the vulnerable system is internet-facing and you cannot patch immediately, contain it first, then investigate for evidence of access; do not wait for proof of compromise before narrowing exposure.

Practitioner takeaway: For KEV-listed flaws like this one, the operational question is whether the attack path was available, because that determines both urgency and whether you need to assume disclosure has already occurred.

Related resources from NHI Mgmt Group

• Guide: Zero-Day and Exploited Vulnerabilities Guide
• How do you patch or mitigate CVE-2021-26085 (Atlassian Confluence Server Pre-Authorization Arbitrary File Read)?
• CVE-2021-26085 (Atlassian Confluence Server Pre-Authorization Arbitrary File Read)
• Is CVE-2023-22518 (Atlassian Confluence Data Center and Server Improper Authorization) being exploited in the wild?
• Is CVE-2023-22515 (Atlassian Confluence Data Center and Server Broken Access Control) being exploited in the wild?