Confluence Server - SSRF (CVE-2021-26072)

CVE-2021-26072 is a vulnerability in the WidgetConnector plugin for Atlassian Confluence Server and Data Center prior to version 5.8.6, which allows remote attackers to exploit a blind Server-Side Request Forgery (SSRF) flaw. This vulnerability could enable attackers to manipulate or access internal network resources, potentially leading to unauthorized information disclosure or further attacks within the internal network.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2021-26072 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. In addition, according to the CrowdSec network, attack volume against CVE-2021-26072 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending requests to the /rest/sharelinks/1.0/link endpoint with a crafted url parameter, enabling server-side request forgery to arbitrary external or internal resources.