CVE-2026-21580 is a stored XSS vulnerability combined with privilege escalation and security misconfiguration issues in Atlassian Confluence Data Center and Server. It affects multiple versions including 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0. The vulnerability allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code in a victim's browser, perform actions as a higher-privileged user, and exploit security misconfigurations. The CVSS 4.0 base score is 8.6, indicating high severity. Atlassian advises upgrading to versions >=9.2.21 or >=10.2.13 to remediate the issue. The vulnerability was reported through Atlassian's Bug Bounty program.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary HTML or JavaScript in the context of a victim's browser, potentially leading to session hijacking or other malicious actions. Additionally, the attacker can escalate privileges to perform actions as higher-privileged users and exploit security misconfigurations to gain further system access or control. This can compromise the confidentiality, integrity, and availability of the affected Confluence instances.

Atlassian has provided official fixes for this vulnerability. Customers should upgrade Confluence Data Center and Server to versions 9.2.21 or later if using the 9.2 branch, or to 10.2.13 or later if using the 10.2 branch. Upgrading to the latest available version is recommended to ensure full remediation. No other mitigation steps are indicated by the vendor advisory.