CVE-2026-21588: DoS (Denial of Service) in Atlassian Confluence Data Center
This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.24 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.17 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Penetration Testing program.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-21588) in Atlassian Confluence Data Center allows an authenticated attacker to cause a Denial of Service (DoS) by disrupting the availability of resources on a host connected to a network. It affects versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0. The CVSS 4.0 base score is 7.1, indicating high severity. Atlassian recommends upgrading to fixed releases: for Confluence Data Center 9.2, versions >=9.2.24; for 10.2, versions >=10.2.17. The vulnerability was identified through Atlassian's Penetration Testing program.
Potential Impact
An authenticated attacker can exploit this vulnerability to cause a Denial of Service, making resources unavailable to legitimate users by disrupting service availability. This can lead to temporary or indefinite service outages affecting Confluence Data Center instances running vulnerable versions.
Mitigation Recommendations
Atlassian has provided official fixes for this vulnerability. Customers should upgrade Confluence Data Center to versions 9.2.24 or later if on the 9.2 branch, or 10.2.17 or later if on the 10.2 branch. If possible, upgrading to the latest available version is recommended. Patch status is confirmed as fixed in these versions. No other mitigation actions are specified.
CVE-2026-21588: DoS (Denial of Service) in Atlassian Confluence Data Center
Description
This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.24 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.17 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Penetration Testing program.
CVSS v4.0
Score 7.1high
Affected software
Atlassian
Confluence Data Center
pkg:maven/com.atlassian.confluence/confluence-data-centerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-21588) in Atlassian Confluence Data Center allows an authenticated attacker to cause a Denial of Service (DoS) by disrupting the availability of resources on a host connected to a network. It affects versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0. The CVSS 4.0 base score is 7.1, indicating high severity. Atlassian recommends upgrading to fixed releases: for Confluence Data Center 9.2, versions >=9.2.24; for 10.2, versions >=10.2.17. The vulnerability was identified through Atlassian's Penetration Testing program.
Potential Impact
An authenticated attacker can exploit this vulnerability to cause a Denial of Service, making resources unavailable to legitimate users by disrupting service availability. This can lead to temporary or indefinite service outages affecting Confluence Data Center instances running vulnerable versions.
Mitigation Recommendations
Atlassian has provided official fixes for this vulnerability. Customers should upgrade Confluence Data Center to versions 9.2.24 or later if on the 9.2 branch, or 10.2.17 or later if on the 10.2 branch. If possible, upgrading to the latest available version is recommended. Patch status is confirmed as fixed in these versions. No other mitigation actions are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- atlassian
- Date Reserved
- 2026-01-01T00:00:40.722Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa97a1355bf5e2cf51ed0a2
Added to database: 09/15/2026, 17:02:11 UTC
Last enriched: 09/15/2026, 17:16:58 UTC
Last updated: 09/16/2026, 03:15:26 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.