Skip to content
Critical RCE Vulnerability in Confluence Data Center Disclosed

Critical RCE Vulnerability in Confluence Data Center Disclosed

First seen 14 Nov 2026, 05:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 05:16 UTC
  • •CVE-2026-90436 is a critical RCE vulnerability in Confluence Data Center with a CVSS of 9.8.
  • •The vulnerability arises from the use of Apache Axis and requires the Remote API feature to be enabled.
  • •No impact on Atlassian Cloud sites; affected organizations must patch their Confluence installations.

Atlassian has disclosed a critical remote code execution vulnerability (CVE-2026-90436) affecting Confluence Data Center, which utilizes a vulnerable third-party library, Apache Axis. This vulnerability allows attackers to execute arbitrary code if the 'Remote API (XML-RPC & SOAP)' feature is enabled. The flaw has a CVSS score of 9.8 and was published on November 6, 2026, with proof-of-concept code made public shortly thereafter. Organizations using Confluence Data Center should assess their configurations and apply necessary patches. Importantly, this issue does not affect Atlassian Cloud sites. The vulnerability is part of a broader trend of critical vulnerabilities affecting multiple Atlassian products, highlighting ongoing security challenges in enterprise software.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 11h ago How this analysis works

Timeline

2026-11-06
CVE-2026-90436 published
Atlassian disclosed a critical RCE vulnerability in Confluence Data Center due to Apache Axis.
Confluence.Atlassian
2026-11-10
PoC code released
Proof-of-concept code for CVE-2026-90436 was made public, increasing the risk of exploitation.
Confluence.Atlassian

More articles in this cluster (2)

Following this threat?

Track Atlassian and CVE-2019-13990 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (25)

1 / 3

Common questions

What versions of Confluence are affected?
Confluence Data Center instances with the Remote API feature enabled are affected by CVE-2026-90436.
Is there a patch available?
Yes, Atlassian has released patches for the vulnerability; organizations should apply them immediately.
How can I mitigate this vulnerability?
Disable the Remote API feature if it is not needed, and ensure all patches are applied to affected systems.