This vulnerability (CVE-2026-21579) in Atlassian Confluence Data Center allows unauthenticated attackers to disclose sensitive information. It affects multiple specific versions including 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0. The CVSS 4.0 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. Atlassian advises upgrading to versions >=9.2.22 or >=10.2.14 to fix the vulnerability. No known exploits in the wild have been reported.

An unauthenticated attacker can exploit this vulnerability to gain access to sensitive information within affected Confluence Data Center instances. This could lead to exposure of confidential data, potentially impacting organizational security and privacy. The vulnerability does not require authentication or user interaction, increasing its risk.

Atlassian recommends upgrading affected Confluence Data Center instances to versions 9.2.22 or later for the 9.2 branch, and 10.2.14 or later for the 10.2 branch. Applying these updates will remediate the information disclosure vulnerability. If immediate upgrade is not possible, follow Atlassian's official guidance and monitor their release notes for further updates. Patch status is confirmed by vendor advisory references.