Skip to main content

Confluence Data Center CVE-2026-21586

| EUVDEUVD-2026-78935 HIGH
Improper Authorization (CWE-285)
2026-09-15 atlassian GHSA-qjg9-922r-8886
Authentication Bypass RCE Atlassian Confluence Data Center
7.1
CVSS 4.0 · Vendor: atlassian
View

Vulnerability Assessment

Weakness
CWE
CWE-285
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

An improper authorization flaw in Atlassian Confluence Data Center lets an authenticated, low-privileged user reach resources and functionality they should not be able to access, resulting in high confidentiality impact against the affected instance. The defect was introduced across a broad set of release trains — 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 — meaning most currently maintained Data Center deployments built on those lines are exposed until upgraded. Atlassian rates the issue 7.1 (CVSS 4.0, AV:N/AC:L/PR:L/UI:N/VC:H) and has shipped fixes in 9.2.24 and 10.2.17; there is no evidence of public exploit code or confirmed active exploitation at time of analysis.

Affected VersionsENISA

Confluence Data Center 9.1.1
Confluence Data Center 7.19.28 to 7.19.30
Confluence Data Center 9.3.1 to 9.3.2
Confluence Data Center 9.5.1 to 9.5.4
Confluence Data Center 10.2.1 to 10.2.15
Confluence Data Center 10.0.2 to 10.0.3
Confluence Data Center 8.9.7 to 8.9.8
Confluence Data Center 9.2.0 to 9.2.23
Confluence Data Center 9.4.0 to 9.4.1
Confluence Data Center 10.1.0 to 10.1.2
Confluence Data Center 8.5.16 to 8.5.31

Affected Packages

euvd confluence_data_center no fix
euvd confluence_data_center_10_0_2_to no fix
euvd confluence_data_center_10_1_0_to no fix
euvd confluence_data_center_10_2_1_to no fix
euvd confluence_data_center_7_19_28_to no fix
euvd confluence_data_center_8_5_16_to no fix
euvd confluence_data_center_8_9_7_to no fix
euvd confluence_data_center_9_2_0_to no fix
euvd confluence_data_center_9_3_1_to no fix
euvd confluence_data_center_9_4_0_to no fix
euvd confluence_data_center_9_5_1_to no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 11 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Confluence Data Center gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (atlassian) PRIMARY 7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (atlassian) · only source for this CVE.

CVSS VectorVendor: atlassian

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center.

This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.24

Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.17

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Penetration Testing program.

Threat Intelligence Overview

EPSS Score
0.3%
Top 74% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Confluence Data Center

View all
CVE-2023-22518 CRITICAL POC
9.8 Oct 31

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
CVE-2022-26134 CRITICAL POC
9.8 Jun 03

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
CVE-2024-21683 HIGH POC
8.8 May 21

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
CVE-2022-42978 HIGH POC
7.5 Nov 15

In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. Rated high severity

CVE-2022-42977 HIGH POC
7.5 Nov 15

The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in

CVE-2022-26136 CRITICAL
9.8 Jul 20

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used

CVE-2021-26085 MEDIUM POC
5.3 Aug 03

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza
CVE-2024-21677 HIGH
8.8 Mar 19

This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. Rated high s
CVE-2024-21673 HIGH
8.8 Jan 16

This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center
CVE-2024-21672 HIGH
8.8 Jan 16

This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center a
CVE-2023-22522 HIGH
8.8 Dec 06

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject u
CVE-2023-22508 HIGH
8.8 Jul 18

This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2026-58704 HIGH POC
8.8
CVE-2025-66301 HIGH POC
8.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-21586 REF https://confluence.atlassian.com/pages/viewpage.action?pageId=1822852209 REF https://jira.atlassian.com/browse/CONFSERVER-104418

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy