CVE-2026-21580 is a stored XSS vulnerability combined with privilege escalation and security misconfiguration issues in Atlassian Confluence Data Center and Server. It enables unauthenticated attackers to execute arbitrary HTML or JavaScript in victims' browsers, perform actions with elevated privileges, and exploit overlooked security best practices. The vulnerability affects multiple versions starting from 7.1.1 and various subsequent releases up to 10.2.0. Atlassian has addressed the issue in versions 9.2.21 and 10.2.13 and later.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary code in the context of a victim's browser, potentially leading to privilege escalation within the Confluence instance. This could allow the attacker to perform unauthorized actions and compromise the system's security configuration. The CVSS 4.0 score of 8.6 reflects a high severity impact with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Atlassian recommends upgrading Confluence Data Center and Server to versions 9.2.21 or later for the 9.2.x branch, and 10.2.13 or later for the 10.2.x branch. If upgrading to the latest version is not possible, these specified fixed versions should be applied to remediate the vulnerability. No other mitigations or temporary fixes are indicated in the advisory.