CVE-2026-21586
Received Received - Intake

Improper Authorization in Confluence Data Center

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Atlassian

Description
This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.24 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.17 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Penetration Testing program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-21586
EUVD
EUVD-2026-78935

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
atlassian confluence_data_center From 9.2.24 (inc)
atlassian confluence_data_center From 10.2.17 (inc)
atlassian confluence_data_center From 10.2.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-21586 is an Improper Authorization vulnerability in Confluence Data Center versions 7.4.0 through 10.2.0. It allows authenticated attackers to gain unintended access, potentially exposing sensitive information or executing arbitrary code. The vulnerability has a CVSS score of 7.1, indicating high severity.

Impact Analysis

This vulnerability can lead to unauthorized access to resources or functionality in Confluence Data Center. Attackers may obtain sensitive information or execute arbitrary code, posing risks to data confidentiality and system integrity.

Mitigation Strategies

Upgrade Confluence Data Center to a fixed version. If using version 9.2, upgrade to 9.2.24 or later. If using 10.2, upgrade to 10.2.17 or later. Download the latest version from Atlassian's download center.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart