Confluence Data Center EUVD-2026-46326

Exploitation is remote and unauthenticated (CVSS PR:N), requiring only network reachability to the Confluence Data Center web service - no user interaction (UI:N) and no credentials are needed. The CVSS 4.0 vector's AT:P flag indicates a specific attack requirement must be met for the exploit to work, so it is not guaranteed against every request; the exact precondition is not detailed in the provided description and should be confirmed against the Atlassian advisory. Limiting factors: the instance must be network-reachable by the attacker (internet-exposed instances are most at risk; those restricted to internal networks or VPN are far less exposed), the deployment must run one of the affected versions (the 7.17.0/7.19.0/8.5.0/8.9.0/9.0.1/9.1.0/9.2.0/10.0.2/10.1.0/10.2.0 lines and not yet be patched to 9.2.22 or 10.2.14), and impact is limited to reading sensitive information - it does not grant write access or code execution.

The signals are moderately aligned toward real-world risk but stop short of an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack - the highest-concern profile - however AT:P (attack requirements present) means exploitation is not fully unconditional, tempering the raw 8.2 score. Impact is confined to confidentiality (VC:H, VI:N, VA:N), so this cannot directly alter data or crash the service. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input, so exploitation probability cannot be quantified from the data given. No SSVC decision data was supplied. Net: a genuine priority for exposed, internet-facing Confluence Data Center instances given the unauthenticated network vector, but the absence of known exploitation and the confidentiality-only impact place it below actively-exploited RCE-class Confluence bugs. CWE is N/A, so root-cause specificity is limited - verify the affected data scope against the Atlassian advisory.

An attacker who can reach a vulnerable Confluence Data Center instance over the network sends a specially crafted request that triggers the disclosure and returns sensitive information without authenticating. Because the attack requires no credentials and low complexity, an exposed internet-facing instance could be probed opportunistically, though the AT:P requirement means the attacker must satisfy a specific precondition for the request to succeed. No public exploit code has been identified at time of analysis.