Skip to main content

Confluence Data Center CVE-2026-21588

| EUVDEUVD-2026-78937 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-09-15 atlassian GHSA-4848-75hf-436m
Denial Of Service Atlassian Confluence Data Center
7.1
CVSS 4.0 · Vendor: atlassian
View

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Authenticated denial of service in Atlassian Confluence Data Center allows a low-privileged logged-in user to make the application unavailable to its intended users, with no confidentiality or integrity impact. The flaw was introduced across a broad swath of releases (8.9.0 through 10.2.0) and Atlassian rates it High with a CVSS 4.0 score of 7.1. Fixed builds are 9.2.24 and later on the 9.2 branch and 10.2.17 and later on the 10.2 branch; no public exploit code or confirmed active exploitation was identified at time of analysis.

Affected VersionsENISA

Confluence Data Center 10.1.0 to 10.1.2
Confluence Data Center 10.2.0 to 10.2.15
Confluence Data Center 9.4.0 to 9.4.1
Confluence Data Center 9.2.0 to 9.2.23
Confluence Data Center 10.0.2 to 10.0.3
Confluence Data Center 9.5.1 to 9.5.4
Confluence Data Center 8.9.7 to 8.9.8
Confluence Data Center 9.1.0 to 9.1.1
Confluence Data Center 9.3.1 to 9.3.2

Affected Packages

euvd confluence_data_center_10_0_2_to no fix
euvd confluence_data_center_10_1_0_to no fix
euvd confluence_data_center_10_2_0_to no fix
euvd confluence_data_center_8_9_7_to no fix
euvd confluence_data_center_9_1_0_to no fix
euvd confluence_data_center_9_2_0_to no fix
euvd confluence_data_center_9_3_1_to no fix
euvd confluence_data_center_9_4_0_to no fix
euvd confluence_data_center_9_5_1_to no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 9 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Confluence Data Center gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (atlassian) PRIMARY 7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (atlassian) · only source for this CVE.

CVSS VectorVendor: atlassian

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.24

Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.17

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Penetration Testing program.

Threat Intelligence Overview

EPSS Score
0.3%
Top 78% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Confluence Data Center

View all
CVE-2023-22518 CRITICAL POC
9.8 Oct 31

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
CVE-2022-26134 CRITICAL POC
9.8 Jun 03

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
CVE-2024-21683 HIGH POC
8.8 May 21

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
CVE-2022-42978 HIGH POC
7.5 Nov 15

In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. Rated high severity

CVE-2022-42977 HIGH POC
7.5 Nov 15

The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in

CVE-2022-26136 CRITICAL
9.8 Jul 20

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used

CVE-2021-26085 MEDIUM POC
5.3 Aug 03

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza
CVE-2024-21677 HIGH
8.8 Mar 19

This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. Rated high s
CVE-2024-21673 HIGH
8.8 Jan 16

This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center
CVE-2024-21672 HIGH
8.8 Jan 16

This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center a
CVE-2023-22522 HIGH
8.8 Dec 06

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject u
CVE-2023-22508 HIGH
8.8 Jul 18

This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-21588 REF https://confluence.atlassian.com/pages/viewpage.action?pageId=1822852209 REF https://jira.atlassian.com/browse/CONFSERVER-104451

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy