Vulnerability-Lookup

CVE-2026-21577 (GCVE-0-2026-21577)

Vulnerability from cvelistv5 – Published: 2026-07-21 17:00 – Updated: 2026-07-22 18:48

Summary

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Penetration Testing program.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 18:32 UTC

CWE

DoS (Denial of Service)
CWE-400 - Uncontrolled Resource Consumption

Assigner

atlassian CNA under the mitre root

CNA scorecard C 61/100 over 10 records in the last 180 days details

References

2 references

URL	Tags
https://confluence.atlassian.com/pages/viewpage.a…
https://jira.atlassian.com/browse/CONFSERVER-104334

Impacted products

1 product

Vendor	Product	Version	CPE status
Atlassian	Confluence Data Center	Affected: 10.2.0 to 10.2.6 Affected: 10.1.0 to 10.1.2 Affected: 10.0.2 to 10.0.3 Affected: 9.5.1 to 9.5.4 Affected: 9.4.0 to 9.4.1 Affected: 9.3.1 to 9.3.2 Affected: 9.2.0 to 9.2.15 Affected: 9.1.0 to 9.1.1 Affected: 9.0.1 to 9.0.3 Unaffected: 10.2.7 to 10.2.14 Unaffected: 9.2.17 to 9.2.22 cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:9.4.1:::::::* cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:9.2.2:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.3:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.4:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.5:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.6:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.7:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.8:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.9:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.10:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.11:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.12:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.13:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.14:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.15:::::::* cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:32:38.139315Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:48:52.568Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "10.2.0 to 10.2.6"
            },
            {
              "status": "affected",
              "version": "10.1.0 to 10.1.2"
            },
            {
              "status": "affected",
              "version": "10.0.2 to 10.0.3"
            },
            {
              "status": "affected",
              "version": "9.5.1 to 9.5.4"
            },
            {
              "status": "affected",
              "version": "9.4.0 to 9.4.1"
            },
            {
              "status": "affected",
              "version": "9.3.1 to 9.3.2"
            },
            {
              "status": "affected",
              "version": "9.2.0 to 9.2.15"
            },
            {
              "status": "affected",
              "version": "9.1.0 to 9.1.1"
            },
            {
              "status": "affected",
              "version": "9.0.1 to 9.0.3"
            },
            {
              "status": "unaffected",
              "version": "10.2.7 to 10.2.14"
            },
            {
              "status": "unaffected",
              "version": "9.2.17 to 9.2.22"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.4.1",
                  "versionStartIncluding": "9.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.3.2",
                  "versionStartIncluding": "9.3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.2.15",
                  "versionStartIncluding": "9.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.4:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.5:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.6:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.7:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.8:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.9:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.10:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.11:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.12:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.13:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.14:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.15:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.1.1",
                  "versionStartIncluding": "9.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.3",
                  "versionStartIncluding": "9.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.17:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.18:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.19:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.20:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.21:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.22:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17\r\n\r\n Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Penetration Testing program."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "DoS (Denial of Service)",
              "lang": "en",
              "type": "DoS (Denial of Service)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T17:00:00.483Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345"
        },
        {
          "url": "https://jira.atlassian.com/browse/CONFSERVER-104334"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2026-21577",
    "datePublished": "2026-07-21T17:00:00.483Z",
    "dateReserved": "2026-01-01T00:00:40.721Z",
    "dateUpdated": "2026-07-22T18:48:52.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-21577",
      "date": "2026-11-09",
      "epss": "0.00426",
      "percentile": "0.37164"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Confluence Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "10.2.0 to 10.2.6"
                  },
                  {
                    "status": "affected",
                    "version": "10.1.0 to 10.1.2"
                  },
                  {
                    "status": "affected",
                    "version": "10.0.2 to 10.0.3"
                  },
                  {
                    "status": "affected",
                    "version": "9.5.1 to 9.5.4"
                  },
                  {
                    "status": "affected",
                    "version": "9.4.0 to 9.4.1"
                  },
                  {
                    "status": "affected",
                    "version": "9.3.1 to 9.3.2"
                  },
                  {
                    "status": "affected",
                    "version": "9.2.0 to 9.2.15"
                  },
                  {
                    "status": "affected",
                    "version": "9.1.0 to 9.1.1"
                  },
                  {
                    "status": "affected",
                    "version": "9.0.1 to 9.0.3"
                  },
                  {
                    "status": "unaffected",
                    "version": "10.2.7 to 10.2.14"
                  },
                  {
                    "status": "unaffected",
                    "version": "9.2.17 to 9.2.22"
                  }
                ]
              }
            ],
            "source": "security@atlassian.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5D96FA93-543E-4520-86FC-11CC5F4F0E67",
                    "versionEndIncluding": "9.0.3",
                    "versionStartIncluding": "9.0.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AABE6E52-C62D-405D-AFA9-2D915054E37B",
                    "versionEndIncluding": "9.1.1",
                    "versionStartIncluding": "9.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4E91D12-AD9C-4879-8F93-E1C0134049BA",
                    "versionEndIncluding": "9.2.15",
                    "versionStartIncluding": "9.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "04741FFB-8960-4F60-AA05-D97CDF5C2E4E",
                    "versionEndIncluding": "9.3.2",
                    "versionStartIncluding": "9.3.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F5B2473F-BEE3-42A5-A3BF-518FF83DA1BC",
                    "versionEndIncluding": "9.4.1",
                    "versionStartIncluding": "9.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8832BB4F-D672-449A-8686-E51F7B5FEC11",
                    "versionEndIncluding": "9.5.4",
                    "versionStartIncluding": "9.5.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FFBCB72C-3928-4912-BEB5-AF347389E722",
                    "versionEndIncluding": "10.0.3",
                    "versionStartIncluding": "10.0.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4D091175-B702-4810-89C4-CD57AC9A691A",
                    "versionEndIncluding": "10.1.2",
                    "versionStartIncluding": "10.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C0FB96F6-E1AB-4568-AB75-FA9E1980340E",
                    "versionEndIncluding": "10.2.6",
                    "versionStartIncluding": "10.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17\r\n\r\n Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Penetration Testing program."
          },
          {
            "lang": "es",
            "value": "Esta vulnerabilidad DoS (denegaci\u00f3n de servicio) de alta gravedad se introdujo en las versiones 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 y 10.2.0 de Confluence Data Center.\n\nEsta vulnerabilidad DoS (denegaci\u00f3n de servicio), con una puntuaci\u00f3n CVSS de 7.1, permite a un atacante autenticado hacer que un recurso no est\u00e9 disponible para sus usuarios previstos al interrumpir temporal o indefinidamente los servicios de un host conectado a una red.\n\nAtlassian recomienda que los clientes de Confluence Data Center actualicen a la \u00faltima versi\u00f3n; si no puede hacerlo, actualice su instancia a una de las versiones fijas compatibles especificadas:\n Confluence Data Center 9.2: Actualice a una versi\u00f3n mayor o igual a 9.2.17\n\n Confluence Data Center 10.2: Actualice a una versi\u00f3n mayor o igual a 10.2.7\n\nConsulte las notas de la versi\u00f3n ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). Puede descargar la \u00faltima versi\u00f3n de Confluence Data Center desde el centro de descargas ([https://www.atlassian.com/software/confluence/download-archives]).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa de pruebas de penetraci\u00f3n."
          }
        ],
        "id": "CVE-2026-21577",
        "lastModified": "2026-10-24T19:10:00.127",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security@atlassian.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-21577",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:32:38.139315Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-21T18:16:57.327",
        "references": [
          {
            "source": "security@atlassian.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-104334"
          }
        ],
        "sourceIdentifier": "security@atlassian.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-21577",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-22T18:32:38.139315Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-400",
                    "description": "CWE-400 Uncontrolled Resource Consumption",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-22T18:32:50.393Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Confluence Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "10.2.0 to 10.2.6"
                },
                {
                  "status": "affected",
                  "version": "10.1.0 to 10.1.2"
                },
                {
                  "status": "affected",
                  "version": "10.0.2 to 10.0.3"
                },
                {
                  "status": "affected",
                  "version": "9.5.1 to 9.5.4"
                },
                {
                  "status": "affected",
                  "version": "9.4.0 to 9.4.1"
                },
                {
                  "status": "affected",
                  "version": "9.3.1 to 9.3.2"
                },
                {
                  "status": "affected",
                  "version": "9.2.0 to 9.2.15"
                },
                {
                  "status": "affected",
                  "version": "9.1.0 to 9.1.1"
                },
                {
                  "status": "affected",
                  "version": "9.0.1 to 9.0.3"
                },
                {
                  "status": "unaffected",
                  "version": "10.2.7 to 10.2.14"
                },
                {
                  "status": "unaffected",
                  "version": "9.2.17 to 9.2.22"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.4.1",
                      "versionStartIncluding": "9.4.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.4.1:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.3.2",
                      "versionStartIncluding": "9.3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.2.15",
                      "versionStartIncluding": "9.2.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.2:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.3:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.4:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.5:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.6:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.7:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.8:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.9:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.10:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.11:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.12:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.13:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.14:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.15:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.1.1",
                      "versionStartIncluding": "9.1.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.0.3",
                      "versionStartIncluding": "9.0.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.17:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.18:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.19:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.20:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.21:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.22:*:*:*:*:*:*:*",
                      "vulnerable": false
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17\r\n\r\n Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Penetration Testing program."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "DoS (Denial of Service)",
                  "lang": "en",
                  "type": "DoS (Denial of Service)"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-21T17:00:00.483Z",
            "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
            "shortName": "atlassian"
          },
          "references": [
            {
              "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345"
            },
            {
              "url": "https://jira.atlassian.com/browse/CONFSERVER-104334"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "assignerShortName": "atlassian",
        "cveId": "CVE-2026-21577",
        "datePublished": "2026-07-21T17:00:00.483Z",
        "dateReserved": "2026-01-01T00:00:40.721Z",
        "dateUpdated": "2026-07-22T18:48:52.568Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0934

Vulnerability from certfr_avis - Published: 2026-07-27 - Updated: 2026-07-27

De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Atlassian	Jira	Jira Software Data Center versions antérieures à 9.12.37
Atlassian	Confluence	Confluence Data Center versions antérieures à 9.2.22
Atlassian	Jira	Jira Software Data Center versions antérieures à 10.3.23
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 11.3.8
Atlassian	Confluence	Confluence Data Center versions antérieures à 10.2.14
Atlassian	Jira	Jira Software Data Center versions antérieures à 11.3.8
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 11.1.1
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 10.3.23

References

Title

Publication Time

Tags

Bulletin de sécurité Atlassian CONFSERVER-104346	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104360	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16655	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16660	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104356	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26803	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26851	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104355	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104287	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26854	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104340	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26801	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16638	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16653	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104350	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104342	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16659	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16619	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-103908	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16654	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104345	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26867	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16639	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16612	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104348	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26871	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104226	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26802	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26850	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-103907	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104349	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16643	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104361	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104334	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16599	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104370	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26869	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26873	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104351	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26812	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16657	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104358	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26804	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104362	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26808	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16658	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16656	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104364	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16652	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104344	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104357	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104353	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104347	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104352	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104363	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-104359	2026-07-21	vendor-advisory
Bulletin de sécurité Atlassian JSWSERVER-26870	2026-07-21	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 9.12.37",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.22",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 10.3.23",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 11.3.8",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 10.2.14",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 11.3.8",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 11.1.1",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.23",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-42041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
    },
    {
      "name": "CVE-2022-37603",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603"
    },
    {
      "name": "CVE-2026-29145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
    },
    {
      "name": "CVE-2026-21577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21577"
    },
    {
      "name": "CVE-2026-44494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
    },
    {
      "name": "CVE-2026-29146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29146"
    },
    {
      "name": "CVE-2026-34043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34043"
    },
    {
      "name": "CVE-2025-62718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
    },
    {
      "name": "CVE-2026-4800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
    },
    {
      "name": "CVE-2026-33671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33671"
    },
    {
      "name": "CVE-2026-42033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
    },
    {
      "name": "CVE-2026-42035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
    },
    {
      "name": "CVE-2026-44495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
    },
    {
      "name": "CVE-2026-42043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
    },
    {
      "name": "CVE-2026-46625",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46625"
    },
    {
      "name": "CVE-2026-40175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
    },
    {
      "name": "CVE-2026-21579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21579"
    },
    {
      "name": "CVE-2022-37601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37601"
    },
    {
      "name": "CVE-2026-42198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42198"
    },
    {
      "name": "CVE-2025-69873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-69873"
    },
    {
      "name": "CVE-2026-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
    },
    {
      "name": "CVE-2026-42583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42583"
    },
    {
      "name": "CVE-2026-2332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
    },
    {
      "name": "CVE-2026-42581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
    },
    {
      "name": "CVE-2026-44705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44705"
    },
    {
      "name": "CVE-2026-42044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
    },
    {
      "name": "CVE-2026-47838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47838"
    },
    {
      "name": "CVE-2026-48779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48779"
    },
    {
      "name": "CVE-2026-6322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6322"
    },
    {
      "name": "CVE-2026-12143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
    },
    {
      "name": "CVE-2026-44486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
    },
    {
      "name": "CVE-2026-42264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42264"
    },
    {
      "name": "CVE-2026-44496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
    },
    {
      "name": "CVE-2026-44492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
    },
    {
      "name": "CVE-2022-37599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37599"
    },
    {
      "name": "CVE-2026-6321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6321"
    },
    {
      "name": "CVE-2026-44490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44490"
    },
    {
      "name": "CVE-2026-29063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
    },
    {
      "name": "CVE-2025-14813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
    },
    {
      "name": "CVE-2026-44488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
    },
    {
      "name": "CVE-2025-11226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11226"
    }
  ],
  "initial_release_date": "2026-07-27T00:00:00",
  "last_revision_date": "2026-07-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0934",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
  "vendor_advisories": [
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104346",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104346"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104360",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104360"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16655",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16655"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16660",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16660"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104356",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104356"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26803",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26803"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26851",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26851"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104355",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104355"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104287",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104287"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26854",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26854"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104340",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104340"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26801",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26801"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16638",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16638"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16653",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16653"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104350",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104350"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104342",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104342"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16659",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16659"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16619",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16619"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103908",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103908"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16654",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16654"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104345",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104345"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26867",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26867"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16639",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16639"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16612",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16612"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104348",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104348"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26871",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26871"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104226",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104226"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26802",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26802"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26850",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26850"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103907",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103907"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104349",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104349"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16643",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16643"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104361",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104361"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104334",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104334"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16599",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16599"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104370",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104370"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26869",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26869"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26873",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26873"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104351",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104351"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26812",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26812"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16657",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16657"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104358",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104358"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26804",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26804"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104362",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104362"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26808",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26808"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16658",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16658"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16656",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16656"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104364",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104364"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16652",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16652"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104344",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104344"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104357",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104357"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104353",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104353"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104347",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104347"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104352",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104352"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104363",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104363"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104359",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104359"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26870",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26870"
    }
  ]
}

FKIE_CVE-2026-21577

Vulnerability from fkie_nvd - Published: 2026-07-21 18:16 - Updated: 2026-10-24 19:10

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@atlassian.com	https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345	Vendor Advisory
	security@atlassian.com	https://jira.atlassian.com/browse/CONFSERVER-104334	Issue Tracking

Impacted products

Vendor	Product	Version
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "10.2.0 to 10.2.6"
            },
            {
              "status": "affected",
              "version": "10.1.0 to 10.1.2"
            },
            {
              "status": "affected",
              "version": "10.0.2 to 10.0.3"
            },
            {
              "status": "affected",
              "version": "9.5.1 to 9.5.4"
            },
            {
              "status": "affected",
              "version": "9.4.0 to 9.4.1"
            },
            {
              "status": "affected",
              "version": "9.3.1 to 9.3.2"
            },
            {
              "status": "affected",
              "version": "9.2.0 to 9.2.15"
            },
            {
              "status": "affected",
              "version": "9.1.0 to 9.1.1"
            },
            {
              "status": "affected",
              "version": "9.0.1 to 9.0.3"
            },
            {
              "status": "unaffected",
              "version": "10.2.7 to 10.2.14"
            },
            {
              "status": "unaffected",
              "version": "9.2.17 to 9.2.22"
            }
          ]
        }
      ],
      "source": "security@atlassian.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D96FA93-543E-4520-86FC-11CC5F4F0E67",
              "versionEndIncluding": "9.0.3",
              "versionStartIncluding": "9.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AABE6E52-C62D-405D-AFA9-2D915054E37B",
              "versionEndIncluding": "9.1.1",
              "versionStartIncluding": "9.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4E91D12-AD9C-4879-8F93-E1C0134049BA",
              "versionEndIncluding": "9.2.15",
              "versionStartIncluding": "9.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "04741FFB-8960-4F60-AA05-D97CDF5C2E4E",
              "versionEndIncluding": "9.3.2",
              "versionStartIncluding": "9.3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5B2473F-BEE3-42A5-A3BF-518FF83DA1BC",
              "versionEndIncluding": "9.4.1",
              "versionStartIncluding": "9.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832BB4F-D672-449A-8686-E51F7B5FEC11",
              "versionEndIncluding": "9.5.4",
              "versionStartIncluding": "9.5.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFBCB72C-3928-4912-BEB5-AF347389E722",
              "versionEndIncluding": "10.0.3",
              "versionStartIncluding": "10.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D091175-B702-4810-89C4-CD57AC9A691A",
              "versionEndIncluding": "10.1.2",
              "versionStartIncluding": "10.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0FB96F6-E1AB-4568-AB75-FA9E1980340E",
              "versionEndIncluding": "10.2.6",
              "versionStartIncluding": "10.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17\r\n\r\n Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Penetration Testing program."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad DoS (denegaci\u00f3n de servicio) de alta gravedad se introdujo en las versiones 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 y 10.2.0 de Confluence Data Center.\n\nEsta vulnerabilidad DoS (denegaci\u00f3n de servicio), con una puntuaci\u00f3n CVSS de 7.1, permite a un atacante autenticado hacer que un recurso no est\u00e9 disponible para sus usuarios previstos al interrumpir temporal o indefinidamente los servicios de un host conectado a una red.\n\nAtlassian recomienda que los clientes de Confluence Data Center actualicen a la \u00faltima versi\u00f3n; si no puede hacerlo, actualice su instancia a una de las versiones fijas compatibles especificadas:\n Confluence Data Center 9.2: Actualice a una versi\u00f3n mayor o igual a 9.2.17\n\n Confluence Data Center 10.2: Actualice a una versi\u00f3n mayor o igual a 10.2.7\n\nConsulte las notas de la versi\u00f3n ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). Puede descargar la \u00faltima versi\u00f3n de Confluence Data Center desde el centro de descargas ([https://www.atlassian.com/software/confluence/download-archives]).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa de pruebas de penetraci\u00f3n."
    }
  ],
  "id": "CVE-2026-21577",
  "lastModified": "2026-10-24T19:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@atlassian.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21577",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-22T18:32:38.139315Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T18:16:57.327",
  "references": [
    {
      "source": "security@atlassian.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104334"
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-2V44-87C2-PXR3

Vulnerability from github – Published: 2026-07-21 18:31 – Updated: 2026-08-10 21:31

Details

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17

Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Penetration Testing program.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-21577"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T18:16:57Z",
    "severity": "HIGH"
  },
  "details": "This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.\n\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\n\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17\n\n Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7\n\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\n\nThis vulnerability was reported via our Penetration Testing program.",
  "id": "GHSA-2v44-87c2-pxr3",
  "modified": "2026-08-10T21:31:56Z",
  "published": "2026-07-21T18:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21577"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104334"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

WID-SEC-W-2026-2460

Vulnerability from csaf_certbund - Published: 2026-07-21 22:00 - Updated: 2026-08-31 22:00

Summary

Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen

Severity

Hoch

Scope

67 vulnerabilities in this advisory, including CVE-2026-21577.

CVE-2026-21577

Known affected: 13 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-21577 (GCVE-0-2026-21577)

CERTFR-2026-AVI-0934

Solutions

FKIE_CVE-2026-21577

GHSA-2V44-87C2-PXR3

WID-SEC-W-2026-2460

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour