CVE-2026-90436 - Remote Code Execution in Confluence Data Center

CVE-2019-13990 - XXE (XML External Entity Injection) Vulnerability In Jira Service Management Data Center and Jira Service Management Server

CVE-2022-1471 - SnakeYAML library RCE Vulnerability impacts Multiple Products

CVE-2023-22522 - RCE Vulnerability In Confluence Data Center and Confluence Server

CVE-2023-22523 - RCE Vulnerability in Assets Discovery

CVE-2023-22524 - RCE Vulnerability in Atlassian Companion App for MacOS

CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server

CVE-2023-22518 - Improper Authorization Vulnerability In Confluence Data Center and Server

CVE-2023-46604 - Apache ActiveMQ RCE Vulnerability impacts Bamboo Data Center and Server

Multiple Products Security Advisory - Git Buffer Overflow - CVE-2022-41903, CVE-2022-23521

Security Bulletin - July 18 2023

Security Bulletin - August 15 2023

Security Bulletin - September 19 2023

Security Bulletin - October 17 2023

Security Bulletin - November 21 2023

Security Bulletin - December 12 2023

Security Bulletin - January 16 2024

Security Bulletin - February 20 2024

Security Bulletin - March 19 2024

Security Bulletin - April 16 2024

Security Bulletin - May 21 2024

Security Bulletin - June 18 2024

Security Bulletin - July 16 2024

Security Bulletin - August 20 2024

Security Bulletin - September 17 2024

Security Bulletin - October 15 2024

Security Bulletin - November 19 2024

Security Bulletin - December 10 2024

Security Bulletin - January 21 2025

Security Bulletin - February 18 2025

Security Bulletin - March 18 2025

Security Bulletin - April 15 2025

Security Bulletin - May 20 2025

Security Bulletin - June 17 2025

Security Bulletin - July 15 2025

Security Bulletin - August 19 2025

Security Bulletin - September 16 2025

Security Bulletin - October 21 2025

Security Bulletin - November 18 2025

Security Bulletin - December 11 2025

Security Bulletin - January 20 2026

Security Bulletin - February 17 2026

Security Bulletin - March 17 2026

Security Bulletin - April 21 2026

Security Bulletin - May 19 2026

Security Bulletin - June 16 2026

Security Bulletin - July 21 2026

CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products

Security Bulletin - August 18 2026

Security Bulletin - September 15 2026

Security Bulletin - October 20 2026

CVE-2026-90436 - Remote Code Execution in Confluence Data Center

The Atlassian Community is here for you.

Confluence Data Center

This vulnerability has no impact on Atlassian Cloud sites, and no action is required. If your Confluence site is accessed via an atlassian.net or jira.com domain, it is securely hosted by Atlassian and not vulnerable to this issue.

Summary of Vulnerability

Confluence utilizes a third-party library Apache Axis as part of its XML-RPC and SOAP APIs. Apache Axis has published a critical vulnerability (CVE-2026-90436) that allows remote code execution.

To be vulnerable, the Confluence instance must have the ‘Remote API (XML-RPC & SOAP)’ enabled. Please note that this setting was turned off by default for new installations starting in Confluence 3.0. This feature was fully removed in Confluence 10.0.

Atlassian rates the severity level of this vulnerability as critical ( 9.3 with the following vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ) per our internal assessment.

This is our assessment, and you should evaluate its applicability to your own IT environment.

This Remote Code Execution vulnerability affects the following versions of Confluence Data Center. Atlassian recommends patching to the latest version or a fixed LTS version. Note that Confluence 10.x and above are not impacted.

Immediately patch to a fixed version

Atlassian recommends that you patch each of your affected installations to the latest version or one of the listed fixed versions below.

Apply temporary mitigations if unable to patch

Turning off "Remote API (XMl-RPC & SOAP)" may cause certain functionality, such as scripts, automations and third-party add-ons, to stop working. You may wish to test the mitigations in a non-production environment before applying them across your sites.

Login to Confluence as an administrator

Click (top-right bar) then ‘General Configuration’ and then ‘Further Configuration'. This can also be accessed via /admin/viewspacesconfig.action

Click (top-right bar) then ‘General Configuration’ and then ‘Further Configuration'. This can also be accessed via /admin/viewspacesconfig.action

Click the ‘Edit’ button on the far right to edit the items on the screen.

Click the ‘Edit’ button on the far right to edit the items on the screen.

Ensure that the checkbox is clear/unselected for 'Remote API (XML-RPC & SOAP)'

Ensure that the checkbox is clear/unselected for 'Remote API (XML-RPC & SOAP)'

Click ‘Save’ at the bottom and when the page reloads, ensure that the checkbox for ‘Remote API (XML-RPC & SOAP)’ is empty/clear. You do not need to restart Confluence - the setting takes effect as soon as you click ‘Save’.

Click ‘Save’ at the bottom and when the page reloads, ensure that the checkbox for ‘Remote API (XML-RPC & SOAP)’ is empty/clear. You do not need to restart Confluence - the setting takes effect as soon as you click ‘Save’.

To validate that the mitigation is set correctly:

Browse to /plugins/servlet/soap-axis1/confluenceservice-v2

Browse to /plugins/servlet/soap-axis1/confluenceservice-v2

If mitigation is set correctly and is working, you will see a ‘HTTP Status 403 - Forbidden’

If mitigation is set correctly and is working, you will see a ‘HTTP Status 403 - Forbidden’

If there are any issues, or if you receive a message ‘confluenceservice-v2’ or ‘AXIS service’ then please re-check the mitigation steps above, and Atlassian support for further assistance.

If there are any issues, or if you receive a message ‘confluenceservice-v2’ or ‘AXIS service’ then please re-check the mitigation steps above, and Atlassian support for further assistance.

Atlassian cannot confirm if your instances have been affected by this vulnerability. You should engage your local security team to check all affected instances for evidence of compromise.

For a full description of the latest versions, see the release notes for your product below.

Confluence Data Center

You can download the latest version for your product from the download center:

Confluence Data Center