Atlassian Confluence security vulnerabilities
Collaboration. Public CVE monitoring for Atlassian Confluence. Vendor security advisories are linked on this page.
Built for Operators of this product.
61 public records · 0 security-fix timeline events. 0 published in the last 7 days. 48 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 2
- Medium 0
- Low 0
2026-08-083 issues2026-11-05
Known exploited
View all known exploited- Critical9.3CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian productsPatch nowKEVEPSS 99.66%Oct 5, 2026
- Medium4.3Atlassian Confluence Server and Data Center Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 41.22%Apr 1, 2021
- Critical9.8Atlassian Confluence Data Center and Server Template Injection VulnerabilityPatch nowKEVEPSS 99.98%Jan 15, 2024
- Critical9.8Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityPatch nowKEVEPSS 100.00%Oct 31, 2023
- Critical9.8Atlassian Confluence Data Center and Server Broken Access Control VulnerabilityPatch nowKEVEPSS 99.22%Oct 4, 2023
- Critical9.8Atlassian Questions For Confluence App Hard-coded Credentials VulnerabilityPatch nowKEVEPSS 98.24%Jul 20, 2022
- Medium5.3Atlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityPatch nowKEVEPSS 99.94%Aug 2, 2021
- Critical9.8Atlassian Confluence Server and Data Center Remote Code Execution VulnerabilityPatch nowKEVEPSS 100.00%Mar 6, 2022
Recently published
Browse catalog- Critical9.3CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian productsPatch nowKEVEPSS 99.66%Oct 5, 2026
- High7.6This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.Check if you run itEPSS 0.46%Aug 18, 2026
- High8.8This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.Check if you run itEPSS 0.46%Aug 18, 2026
- High7.1This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.Check if you run itEPSS 0.43%Jul 21, 2026
- Critical9.1Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 5.38%May 12, 2026
- Critical9.4This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.Check if you run itEPSS 1.34%Apr 21, 2026
- High8.6This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.Check if you run itEPSS 0.61%Mar 17, 2026
- High8.0MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).Check this weekEPSS 11.50%Mar 10, 2026
- High8.2MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).Check this weekEPSS 13.00%Mar 10, 2026
- High7.7Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicCheck if you run itEPSS 0.22%Feb 6, 2026