Which versions of Confluence Data Center are affected by CVE-2026-21577?

Atlassian Confluence Data Center versions 9.0.x through 10.2.x contain an authenticated denial-of-service vulnerability that could render the collaboration platform unavailable to all users.

How to fix or mitigate CVE-2026-21577?

Within 24 hours, inventory all Confluence Data Center instances in your environment and identify which are running versions 9.0.x through 10.2.x, documenting critical user dependencies and business functions. Within 7 days, implement interim controls including restricting Confluence access to verified, trusted user accounts only; deploy resource monitoring to detect anomalous consumption patterns; and establish an incident response runbook for immediate escalation if availability is compromised. Within 30 days, maintain active monitoring of Atlassian's security advisories for patch availability, coordinate with vendor communications, and prepare a pre-production testing and deployment plan for any released updates.

Confluence Data Center CVE-2026-21577

Q: What is the CVSS score of CVE-2026-21577?

CVE-2026-21577 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46327 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 atlassian

GHSA-2v44-87c2-pxr3

Denial Of Service Atlassian Confluence Data Center

7.1

CVSS 4.0 · Vendor: atlassian

Severity by source

Vendor (atlassian) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (atlassian) · only source for this CVE.

CVSS VectorVendor: atlassian

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 18:01 vuln.today

CVE Published

Jul 21, 2026 - 17:00 cve.org

HIGH 7.1

DescriptionCVE.org

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17

Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Penetration Testing program.

AnalysisAI

Denial of service in Atlassian Confluence Data Center allows an authenticated attacker to render the application unavailable to legitimate users by triggering resource exhaustion that disrupts the host's services. Affected releases span the 9.0.x through 10.2.x branches, with a CVSS 4.0 score of 7.1 (High) driven entirely by availability impact. No public exploit has been identified at time of analysis; the flaw was discovered internally via Atlassian's penetration testing program rather than through in-the-wild activity.