Atlassian Confluence CVE-2026-21580

Exploitation requires reaching a Confluence content field that stores attacker input and is later rendered to other users; per the vendor CVSS the attacker needs no authentication (PR:N) and network access to the Confluence web interface. The realistic limiting factor for the stored-XSS component is that a victim - ideally a higher-privileged user such as an administrator - must view the poisoned content for the script to fire and for the privilege escalation to occur, which is at odds with the advisory's UI:N rating and should be validated against Atlassian's write-up. Affected deployments are on-premises Confluence Data Center/Server on the specific 7.x-10.2.x branches listed; Atlassian Cloud is not indicated as affected, and instances not network-reachable by the attacker are correspondingly harder to exploit.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with high impact to confidentiality, integrity, and availability - a genuine high-priority profile for an internet- or intranet-exposed collaboration server. Two signals temper raw severity: EPSS data was not supplied and the CVE is not listed in CISA KEV, and no public POC is referenced, so this is a critical-by-CVSS issue without confirmed exploitation. The UI:N rating deserves scrutiny - stored XSS normally requires a victim to view the poisoned content (i.e., some user interaction), so the 'no user interaction' rating and the discrepancy between the header score (9.3) and the description's stated 8.6 should be verified against Atlassian's advisory. Even without exploitation evidence, Confluence's role as a repository of sensitive internal knowledge and its history of being aggressively targeted mean any operator running an affected branch should treat patching as urgent rather than routine. Net: real priority driven by exposure and impact, not by demonstrated in-the-wild activity.

An attacker submits crafted content to a Confluence page, comment, or other user-editable field so that malicious JavaScript is stored server-side; when an administrator or higher-privileged user later views that content, the script executes in their authenticated session and performs privileged actions on the attacker's behalf (e.g., creating an admin account or altering configuration). Given the network attack vector and low complexity, no special tooling is required, though no public POC is referenced at time of analysis.