Atlassian Confluence Vulnerabilities: 10 of 71 CVEs Are on CISA’s Exploited List, and 7 of Those Were Used in Ransomware

As of November 13, 2026, NVD and Atlassian list 71 Atlassian Confluence vulnerabilities in Confluence Server and Data Center, and CISA counts 10 of them as exploited, 7 with known ransomware use. The newest is CVE-2026-90436, a critical Apache Axis flaw in the Remote API fixed in 9.2.28. The last one CISA added, CVE-2026-21589, got a 3 day federal deadline.

Key findings

1. NVD holds 71 CVEs for Confluence Server and Data Center from 2005 to November 2026 (counting CVE-2026-90436, which NVD files under Apache Axis but Atlassian has a Confluence advisory for). 13 score 9.0 or higher.
2. 10 are in CISA’s Known Exploited Vulnerabilities catalog, 14% of the total. 10 of Atlassian’s 14 KEV entries affect Confluence.
3. 7 of the 10 carry CISA’s Known ransomware flag, 70%, against 20% across all 1779 KEV entries.
4. For the 6 Confluence CVEs published after KEV’s first entries on November 3, 2021, the median gap from CVE publication to KEV listing is 7.5 days. CVE-2022-26134 was listed a day before its CVE record was published.
5. CVE-2026-21589, published October 5, 2026, reached KEV on October 15 with a 3 day fix window, the shortest any Confluence entry has had.
6. Of 12 Confluence CVEs since May 2024, Atlassian lists the 8.5 LTS line as affected with no fix for 5, all from 2026, including the two 2026 flaws scored 9.3.
7. Atlassian’s October 20, 2026 bulletin listed 31 Confluence Data Center vulnerabilities, every one in a third-party dependency such as Tomcat, Netty or Bouncy Castle, and none first-party.

The exploited ten: every Confluence CVE in CISA KEV

CISA’s catalog version 2026.11.10 lists 10 Confluence CVEs. Seven have the ransomware flag set to Known. Four of the ten are template or OGNL injection bugs that lead to remote code execution: CVE-2019-3396, CVE-2021-26084, CVE-2022-26134 and CVE-2023-22527, all four flagged for ransomware. Red rows carry the ransomware flag.

Fixed versions are from the Atlassian-authored CVE records and NVD configurations; For CVE-2022-26138 the CVE record lists affected Questions for Confluence app versions but no fixed version; the hard-coded account is named disabledsystemuser. CVSS is Atlassian’s score where it published one, otherwise NVD’s v3.x score.

Figure 1. From CVE publication to KEV listing, for the 6 entries disclosed after the catalog launched

The four older entries, from 2019 and 2021, were disclosed before the catalog existed. CISA added three of them on its first day, November 3, 2021, and CVE-2021-26085 on March 28, 2022. Among the six disclosed later, the gap ran from -1 to 10 days. The federal window shrank from 21 days for CVE-2022-26138, CVE-2023-22518 and CVE-2023-22527 to 3 days for CVE-2026-21589, whose KEV entry cites BOD 26-04 and its forensic triage requirement. CVE-2026-21589 is not flagged for ransomware as of catalog 2026.11.10. Our analysis of the full KEV catalog compares these windows across vendors.

Atlassian Confluence authentication bypass vulnerability: CVE-2023-22515 and CVE-2023-22518

Two flaws match that search, published 27 days apart in October 2023. CVE-2023-22515, published October 4, let outside attackers create administrator accounts on Data Center and Server 8.0.0 and later; the fixed versions were 8.3.3, 8.4.3 and 8.5.2. CISA listed it the next day with an 8 day deadline. The joint CISA, FBI and MS-ISAC advisory AA23-289A of October 16, 2023 says threat actors exploited it as a zero-day and expected “widespread, continued exploitation”. CVE-2023-22518, published October 31, affected all versions and let an unauthenticated attacker reset Confluence; Atlassian’s record lists fixes in 7.19.16, 8.3.4, 8.4.4, 8.5.3 and 8.6.1, and CISA listed it 7 days later. Both now carry the ransomware flag. An older case, CVE-2017-7415, let attackers read any page through the drafts diff REST resource in Confluence 6.x before 6.0.7.

Which Confluence versions are still exposed: the LTS matrix

Atlassian fixes Data Center bugs on Long Term Support lines. We read the affected and fixed versions from every Atlassian-written CVE record since May 2024 and placed them on the four LTS lines. As of November 13, Atlassian’s end-of-life policy still lists 9.2 (to December 10, 2026) and 10.2 (to December 2, 2027) as supported LTS releases; 7.19 and 8.5 no longer appear on it.

Figure 2. Every Confluence Data Center CVE since May 2024, by LTS line

The pattern is plain from 2025 on. 8.5 still got a fix for CVE-2025-22166 (8.5.25), then none: Atlassian lists 8.5 as affected by 5 2026 CVEs, including CVE-2026-21589, which is in KEV, and names no 8.5 fix for any of them. 7.19 is in the same position for 5 2026 CVEs. On 9.2, the version needed to clear every row is 9.2.28; on 10.2 it is 10.2.19. 9.2 itself leaves support on December 10, 2026, 27 days after this report, and CVE-2026-90436 does not affect 10.x at all.

“No fix” means the Atlassian CVE record names the line as affected and lists no fixed version on it. CVE-2026-90436 cells come from Atlassian’s advisory (1.x to 9.x affected, 9.2.28 fixed, 10.x not affected).

Atlassian Confluence vulnerabilities by year

Figure 3. Confluence Server and Data Center CVEs per year, by severity, 2005 to 2026

Bug classes: what gets exploited

Figure 4. Confluence CVEs by bug class, with KEV entries in red

Code execution and injection bugs are 17 of 71 CVEs but 4 of the 10 KEV entries. Cross-site scripting is the most common class, 22 CVEs, and none has reached KEV. Access control flaws (10) supplied two of the most damaging entries, CVE-2023-22515 and CVE-2023-22518, plus the hard-coded password in the Questions for Confluence app, CVE-2022-26138. We assigned classes with keyword rules over each NVD description; the methodology lists them.

Atlassian Confluence vulnerabilities list: all 71 CVEs

Filter by KEV status, critical score or year, or search any text. Click the CVSS header to sort by score.

Third-party dependencies: the October 20, 2026 bulletin

Atlassian publishes Security Bulletins on the third Tuesday of each month. Its October 20, 2026 bulletin reports 162 high-severity and 14 critical-severity third-party vulnerabilities across all products. For Confluence Data Center it lists 31 rows, 5 critical and 26 high, all in bundled libraries: Tomcat (coyote and catalina), Netty, Bouncy Castle, Jackson, Spring, axios and others. Atlassian says its use of the dependency carries a lower, non-critical risk for the five critical rows. The fixed versions are 11.0.0, 10.2.19 and 9.2.26. The 8.5 and 7.19 LTS lines appear in the affected list and get no fix.

CVE-2026-90436 is also a third-party library flaw, but one Atlassian did rate critical for Confluence. It sits in Apache Axis 1.x, which Apache marks “unsupported when assigned” in its CVE record, and it got a standalone advisory; the workaround is to clear the “Remote API (XML-RPC and SOAP)” checkbox under General Configuration, then Further Configuration. Atlassian’s CONFSERVER-104610 ticket notes the API was fully removed in Confluence 10.0.

Is Confluence being phased out?

What this means for MSPs

Inventory by line, not by product name. A client on 8.5 or 7.19 LTS has no fixed version for 5 of the 2026 CVEs, including CVE-2026-21589, which CISA lists as exploited. The only fixes are an upgrade to 9.2.28 or later, or to 10.2.19 or later. With 9.2 leaving support on December 10, 2026, 10.2.19 is the target that lasts to December 2027.

Take Confluence off the open internet where you can. Atlassian’s CVE-2026-21589 advisory lists removing public access, a WAF rule or a Tomcat RewriteValve rule as interim mitigations, and says exploitation needs the exact file name and path. CISA gave federal agencies 3 days.

Turn off the Remote API on 9.2 today if nothing depends on it. For CVE-2026-90436 Atlassian says the setting takes effect on save without a restart, and that a 403 at /plugins/servlet/soap-axis1/confluenceservice-v2 confirms it. It warns that scripts, automations and some add-ons may stop working, so check integrations first.

Treat an exploited Confluence CVE as an incident, not a patch. Seven of the ten KEV entries are flagged for ransomware use. After CVE-2023-22515, which attackers used to create unauthorized administrator accounts, AA23-289A told defenders to hunt for malicious activity with its detection signatures and indicators of compromise, and Atlassian says it “cannot confirm if your instances have been affected” in both 2026 critical advisories. Our ransomware initial access analysis covers the other ways attackers get in.

Frequently asked questions

What are the current vulnerabilities in Confluence?

The newest is CVE-2026-90436, a critical (CVSS 9.3) remote code execution flaw in the Apache Axis 1.x library that Confluence Data Center uses for its XML-RPC and SOAP Remote API. Atlassian’s advisory is timestamped November 9, 2026, 22:00 PST. Versions 1.x to 9.x are affected, 10.x is not, and the fix is 9.2.28. Before it came CVE-2026-21589 (arbitrary file access, CVSS 9.3), fixed in 9.2.26 and 10.2.19 and added to CISA KEV on October 15, 2026.

How many Atlassian Confluence vulnerabilities are actively exploited?

10 Confluence Server and Data Center CVEs are in CISA’s Known Exploited Vulnerabilities catalog (version 2026.11.10), and 7 of them carry the Known ransomware flag. That is 70% against 20% for the catalog as a whole (361 of 1779 entries).

What is the Atlassian Confluence authentication bypass vulnerability?

Usually CVE-2023-22515, a broken access control flaw that let unauthenticated attackers create Confluence administrator accounts on Data Center and Server 8.0.0 to 8.5.1. CISA added it to KEV on October 5, 2023, one day after the CVE was published, and a joint CISA, FBI and MS-ISAC advisory on October 16, 2023 said it was exploited as a zero-day. CVE-2023-22518, an improper authorization flaw that allows an unauthenticated reset of Confluence, followed on October 31, 2023.

Is Confluence being phased out?

Confluence Server is. Atlassian ended support for all Server products on February 15, 2024. Confluence Data Center continues: Atlassian’s end-of-life policy lists 10.2 as a Long Term Support release supported to December 2, 2027 and 11.0 to October 8, 2028. The 9.2 LTS line reaches end of support on December 10, 2026.

How secure is Confluence?

Confluence has a heavier exploitation record than most products. 10 of its 71 CVEs, or 14%, are in CISA KEV, and 7 of those carry the ransomware flag. Four are template or OGNL injection bugs that lead to remote code execution. The 5 Confluence CVEs published since July 2022 that reached KEV were all listed within 10 days of publication.

What are the top 5 Confluence CVEs to patch?

By exploitation record: CVE-2022-26134 and CVE-2021-26084 (OGNL injection), CVE-2023-22527 (template injection), CVE-2023-22515 (admin account creation) and CVE-2023-22518 (unauthenticated reset). All five are in CISA KEV with the ransomware flag set to Known. On currently supported lines, the most recent priorities are CVE-2026-21589 (in KEV) and CVE-2026-90436.

Free to cite and republish with a link to this page.

Methodology

References

1. Atlassian, CVE-2026-90436, Remote Code Execution in Confluence Data Center. Accessed November 2026.
2. Atlassian, CONFSERVER-104610, Remote Code Execution in Confluence Data Center, CVE-2026-90436. Accessed November 2026.
3. CVE Program, CVE-2026-90436 record (Apache Axis 1.x). Accessed November 2026.
4. Atlassian, CVE-2026-21589, Arbitrary File Access Vulnerability impacts Multiple Products. Accessed November 2026.
5. Atlassian, Security Bulletin, October 20, 2026. Accessed November 2026.
6. Atlassian, Security Advisories and Bulletins. Accessed November 2026.
7. Atlassian, Atlassian Support End of Life Policy. Accessed November 2026.
8. Atlassian, Server end of support. Accessed November 2026.
9. Atlassian, Acceptable Use Policy (effective October 7, 2025). Accessed November 2026.
10. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
11. CISA, FBI and MS-ISAC, AA23-289A, Threat Actors Exploit Atlassian Confluence CVE-2023-22515. Accessed November 2026.
12. CISA, BOD 26-04. Accessed November 2026.
13. NIST NVD API 2.0, Confluence Data Center CPE query. Accessed November 2026.
14. CVE Program, CVE Services API records for each in-scope CVE. Accessed November 2026.