CVE-2026-21586

Atlassian Confluence Data Center contains a high-severity improper authorization (broken access control) flaw introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0. A low-privileged authenticated attacker triggers it by accessing resources or functionality outside their authorized scope, which the product fails to restrict. Successful abuse grants unintended access that can expose sensitive information or restricted features and, in some cases, may allow arbitrary code execution. The affected population is self-hosted Confluence Data Center deployments on the listed versions that have not yet applied the 9.2.24 or 10.2.17 fixes. The flaw was found through Atlassian's penetration testing program; no public proof of concept or in-the-wild exploitation is known, and the CVE is not in CISA's KEV catalog.

What to do: Upgrade Confluence Data Center immediately: instances on the 9.2 branch to 9.2.24 or later, and instances on 9.3.x–10.2.x (or any older affected line) to 10.2.17 or the latest release. Until patched, restrict Confluence to trusted networks or VPN, minimize low-privilege account grants, and audit logs for authenticated users accessing spaces, pages, or administrative functions outside their expected permissions.