CVE-2026-21588

CVE-2026-21588 is a high-severity denial-of-service (DoS) vulnerability affecting multiple versions of Atlassian's self-hosted Confluence Data Center, introduced in versions 8.9.0 through 10.2.0 on the listed branches. An authenticated attacker with low privileges can trigger the flaw over the network with no user interaction, temporarily or indefinitely disrupting the availability of the Confluence host for legitimate users. The CVSS 4.0 score of 7.1 reflects high availability impact only; confidentiality and integrity are not compromised. The flaw was found through Atlassian's penetration testing program, is not in the CISA KEV catalog, and has no known public proof-of-concept or observed exploitation. All organizations running Confluence Data Center on the affected versions are exposed, with a reduced (but not eliminated) risk profile since valid credentials are required.

What to do: Upgrade Confluence Data Center 9.2.x to 9.2.24 or later and 10.2.x to 10.2.17 or later; if running an older affected branch (8.9, 9.0, 9.1, 9.3, 9.4, 9.5, 10.0, 10.1), upgrade to the latest release since no backported fixes are specified. In the interim, audit and restrict authenticated user accounts, apply rate limiting or WAF rules to detect abnormal request patterns, and monitor Confluence logs for repeated resource-exhaustion events tied to low-privileged users.