CVE-2026-21588: Atlassian Confluence Data Center vulnerability
This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.24 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.17 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Penetration Testing program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Atlassian Confluence Data Centerto a version that resolves this vulnerability.Fixed in 10.2.17 - Upgrade
Upgrade
Atlassian Confluence Data Centerto a version that resolves this vulnerability.Fixed in 9.2.24
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Confluence Data Center. The vulnerability can disrupt services on a network-connected host, making resources unavailable to intended users.
Which fixed versions are specified if upgrading to the latest release is not immediately possible?
Upgrade Confluence Data Center 9.2 to version 9.2.24 or later, or Confluence Data Center 10.2 to version 10.2.17 or later. Atlassian otherwise recommends upgrading to the latest version.
Are the listed affected releases vulnerable by default?
The provided information identifies affected versions but does not state whether a particular configuration, feature, or non-default setting is required. It does state that exploitation requires authentication.