CVE-2026-21580: 
Confluence Server vulnerability analysis and mitigation

CVE-2026-21580 is a Critical-severity Stored XSS, Privilege Escalation, and Security Misconfiguration vulnerability affecting Atlassian Confluence Data Center and Server. It was introduced across multiple version branches starting from 7.1.1 and affects Confluence Data Center versions 7.19.27–7.19.30, 8.5.15–8.5.31, 8.9.6–8.9.8, 9.0.3, 9.1.0–9.1.1, 9.2.0–9.2.20, 9.3.1–9.3.2, 9.4.0–9.4.1, 9.5.1–9.5.4, 10.0.2–10.0.3, 10.1.0–10.1.2, and 10.2.0–10.2.11; Confluence Server versions 7.19.27–7.19.30 and 8.5.15–8.5.31 are also affected. The vulnerability was disclosed on August 18, 2026, and was reported through Atlassian's Bug Bounty program. It carries a CVSS v4.0 base score of 9.3 (Critical) and a vendor-assigned CVSS score of 8.6 (GitHub Advisory, Atlassian Bulletin).

The vulnerability combines three weakness classes: Stored Cross-Site Scripting (XSS), Privilege Escalation (PrivEsc), and Security Misconfiguration — no specific CWE has been formally assigned in the advisory. An unauthenticated attacker can inject malicious HTML or JavaScript into Confluence content that is persistently stored and later executed in the browsers of other users, including administrators. The privilege escalation component allows the attacker to perform actions as a higher-privileged user by leveraging the stored XSS payload, while the security misconfiguration aspect exposes the system through overlooked security best-practice controls. No public proof-of-concept code has been identified at the time of disclosure (GitHub Advisory, Atlassian Bulletin).

Successful exploitation allows an unauthenticated attacker to execute arbitrary HTML or JavaScript in victims' browsers, potentially hijacking authenticated sessions, stealing credentials, or performing unauthorized actions on behalf of higher-privileged users including administrators. The privilege escalation component means an attacker could gain administrative control over the Confluence instance, enabling access to sensitive organizational data, modification of content, and potential lateral movement within the enterprise environment. The security misconfiguration aspect further broadens the attack surface by exposing the system to unauthorized access through overlooked security controls (GitHub Advisory, Atlassian Bulletin).

As of the disclosure date (August 18, 2026), there is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation. The EPSS score is reported as 0.0, and no threat actor attribution has been identified. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. Despite the lack of known exploitation, the unauthenticated attack vector and low attack complexity make this a high-priority patching target (GitHub Advisory, Atlassian Bulletin).

Atlassian recommends upgrading Confluence Data Center and Server to the latest available version. For customers unable to upgrade to the latest release, the minimum fixed versions are: 9.2.21 or later for the 9.2 branch, and 10.2.13 or later for the 10.2 branch. The recommended versions as of the bulletin date are 10.2.15 (LTS) for Data Center and 9.2.23 (LTS) for Data Center. Updated releases can be downloaded from the Atlassian download center. No configuration-based workaround has been published; patching is the only recommended remediation (Atlassian Bulletin, GitHub Advisory).

The vulnerability received coverage from security aggregation sites including SecurityOnline.info and threat intelligence platforms such as VulDB and radar.offseq.com shortly after disclosure. Social media activity was observed on Mastodon (infosec.exchange and mastodon.social) within hours of publication, indicating community awareness. No notable independent researcher commentary or vendor statements beyond the official Atlassian bulletin have been identified at this time (Atlassian Bulletin).