CVE-2026-21580

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21580", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "dateReserved": "2026-01-01T00:00:40.721Z", "datePublished": "2026-08-18T22:00:00.396Z", "dateUpdated": "2026-08-21T14:45:07.562Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Confluence Data Center", "versions": [{"version": "10.2.0 to 10.2.11", "status": "affected"}, {"version": "10.1.0 to 10.1.2", "status": "affected"}, {"version": "10.0.2 to 10.0.3", "status": "affected"}, {"version": "9.5.1 to 9.5.4", "status": "affected"}, {"version": "9.4.0 to 9.4.1", "status": "affected"}, {"version": "9.3.1 to 9.3.2", "status": "affected"}, {"version": "9.2.0 to 9.2.20", "status": "affected"}, {"version": "9.1.0 to 9.1.1", "status": "affected"}, {"version": "9.0.3", "status": "affected"}, {"version": "8.9.6 to 8.9.8", "status": "affected"}, {"version": "8.5.15 to 8.5.31", "status": "affected"}, {"version": "7.19.27 to 7.19.30", "status": "affected"}, {"version": "10.2.13 to 10.2.15", "status": "unaffected"}, {"version": "9.2.21 to 9.2.23", "status": "unaffected"}]}, {"vendor": "Atlassian", "product": "Confluence Server", "versions": [{"version": "8.5.15 to 8.5.31", "status": "affected"}, {"version": "7.19.27 to 7.19.30", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server.\r\n\r\nThis Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability, with a CVSS Score of 8.6, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser, perform actions as a higher-privileged user, and to get into the system utilizing loopholes exposed from security best-practices being overlooked.\r\n\r\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.21\r\n\r\n Confluence Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.13\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center and Server from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Bug Bounty program."}], "problemTypes": [{"descriptions": [{"description": "Stored XSS", "lang": "en", "type": "Stored XSS"}]}], "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768"}, {"url": "https://jira.atlassian.com/browse/CONFSERVER-104381"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.4.0", "versionEndIncluding": "9.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.4.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.3.1", "versionEndIncluding": "9.3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.2.0", "versionEndIncluding": "9.2.20", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.3:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.4:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.5:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.6:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.7:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.8:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.9:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.10:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.11:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.12:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.13:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.14:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.15:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.16:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.17:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.18:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.19:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.20:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.1.0", "versionEndIncluding": "9.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.0.3:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.9.6", "versionEndIncluding": "8.9.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.15", "versionEndIncluding": "8.5.31", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.22:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.23:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.24:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.25:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.26:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.27:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.28:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.29:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.30:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.31:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.19.27", "versionEndIncluding": "7.19.30", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.21:*:*:*:*:*:*:*", "vulnerable": false}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.22:*:*:*:*:*:*:*", "vulnerable": false}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.23:*:*:*:*:*:*:*", "vulnerable": false}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.15", "versionEndIncluding": "8.5.31", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.22:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.23:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.24:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.25:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.26:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.27:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.28:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.29:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.30:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.31:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.19.27", "versionEndIncluding": "7.19.30", "vulnerable": true}]}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2026-08-18T22:00:00.396Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T03:55:22.938181Z", "id": "CVE-2026-21580", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T14:45:07.562Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21580", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T03:55:22.938181Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:26:54.524Z"}}], "cna": {"metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "Atlassian", "product": "Confluence Data Center", "versions": [{"status": "affected", "version": "10.2.0 to 10.2.11"}, {"status": "affected", "version": "10.1.0 to 10.1.2"}, {"status": "affected", "version": "10.0.2 to 10.0.3"}, {"status": "affected", "version": "9.5.1 to 9.5.4"}, {"status": "affected", "version": "9.4.0 to 9.4.1"}, {"status": "affected", "version": "9.3.1 to 9.3.2"}, {"status": "affected", "version": "9.2.0 to 9.2.20"}, {"status": "affected", "version": "9.1.0 to 9.1.1"}, {"status": "affected", "version": "9.0.3"}, {"status": "affected", "version": "8.9.6 to 8.9.8"}, {"status": "affected", "version": "8.5.15 to 8.5.31"}, {"status": "affected", "version": "7.19.27 to 7.19.30"}, {"status": "unaffected", "version": "10.2.13 to 10.2.15"}, {"status": "unaffected", "version": "9.2.21 to 9.2.23"}]}, {"vendor": "Atlassian", "product": "Confluence Server", "versions": [{"status": "affected", "version": "8.5.15 to 8.5.31"}, {"status": "affected", "version": "7.19.27 to 7.19.30"}]}], "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768"}, {"url": "https://jira.atlassian.com/browse/CONFSERVER-104381"}], "descriptions": [{"lang": "en", "value": "This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server.\r\n\r\nThis Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability, with a CVSS Score of 8.6, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser, perform actions as a higher-privileged user, and to get into the system utilizing loopholes exposed from security best-practices being overlooked.\r\n\r\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.21\r\n\r\n Confluence Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.13\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center and Server from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Bug Bounty program."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "Stored XSS", "description": "Stored XSS"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.4.1", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.4.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.3.2", "versionStartIncluding": "9.3.1"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.2.20", "versionStartIncluding": "9.2.0"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.3:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.4:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.5:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.6:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.7:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.8:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.9:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.10:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.11:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.12:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.13:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.14:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.15:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.16:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.17:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.18:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.19:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.20:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.1.1", "versionStartIncluding": "9.1.0"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.0.3:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "8.9.8", "versionStartIncluding": "8.9.6"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "8.5.31", "versionStartIncluding": "8.5.15"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.22:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.23:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.24:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.25:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.26:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.27:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.28:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.29:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.30:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.31:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "7.19.30", "versionStartIncluding": "7.19.27"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.21:*:*:*:*:*:*:*", "vulnerable": false}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.22:*:*:*:*:*:*:*", "vulnerable": false}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.23:*:*:*:*:*:*:*", "vulnerable": false}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "8.5.31", "versionStartIncluding": "8.5.15"}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.22:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.23:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.24:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.25:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.26:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.27:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.28:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.29:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.30:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:8.5.31:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "7.19.30", "versionStartIncluding": "7.19.27"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2026-08-18T22:00:00.396Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21580", "state": "PUBLISHED", "dateUpdated": "2026-08-20T15:36:48.127Z", "dateReserved": "2026-01-01T00:00:40.721Z", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "datePublished": "2026-08-18T22:00:00.396Z", "assignerShortName": "atlassian"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Confluence Data Center", "vendor": "Atlassian", "versions": [{"status": "affected", "version": "10.2.0 to 10.2.11"}, {"status": "affected", "version": "10.1.0 to 10.1.2"}, {"status": "affected", "version": "10.0.2 to 10.0.3"}, {"status": "affected", "version": "9.5.1 to 9.5.4"}, {"status": "affected", "version": "9.4.0 to 9.4.1"}, {"status": "affected", "version": "9.3.1 to 9.3.2"}, {"status": "affected", "version": "9.2.0 to 9.2.20"}, {"status": "affected", "version": "9.1.0 to 9.1.1"}, {"status": "affected", "version": "9.0.3"}, {"status": "affected", "version": "8.9.6 to 8.9.8"}, {"status": "affected", "version": "8.5.15 to 8.5.31"}, {"status": "affected", "version": "7.19.27 to 7.19.30"}, {"status": "unaffected", "version": "10.2.13 to 10.2.15"}, {"status": "unaffected", "version": "9.2.21 to 9.2.23"}]}, {"product": "Confluence Server", "vendor": "Atlassian", "versions": [{"status": "affected", "version": "8.5.15 to 8.5.31"}, {"status": "affected", "version": "7.19.27 to 7.19.30"}]}], "source": "security@atlassian.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server.\r\n\r\nThis Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability, with a CVSS Score of 8.6, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser, perform actions as a higher-privileged user, and to get into the system utilizing loopholes exposed from security best-practices being overlooked.\r\n\r\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.21\r\n\r\n Confluence Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.13\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center and Server from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Bug Bounty program."}, {"lang": "es", "value": "Esta vulnerabilidad de gravedad Cr\u00edtica de XSS Almacenado, PrivEsc (escalada de privilegios) y Mala Configuraci\u00f3n de Seguridad fue introducida en las versiones 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 y 10.2.0 de Confluence Data Center y Server.\n\nEsta vulnerabilidad de XSS Almacenado, PrivEsc (escalada de privilegios) y Mala Configuraci\u00f3n de Seguridad, con una Puntuaci\u00f3n CVSS de 8.6, permite a un atacante no autenticado ejecutar c\u00f3digo HTML o JavaScript arbitrario en el navegador de una v\u00edctima, realizar acciones como un usuario con mayores privilegios y acceder al sistema utilizando lagunas expuestas por la omisi\u00f3n de las mejores pr\u00e1cticas de seguridad.\n\nAtlassian recomienda que los clientes de Confluence Data Center y Server actualicen a la \u00faltima versi\u00f3n; si no puede hacerlo, actualice su instancia a una de las versiones fijas compatibles especificadas:\n Confluence Data Center y Server 9.2: Actualice a una versi\u00f3n mayor o igual a 9.2.21\n\n Confluence Data Center y Server 10.2: Actualice a una versi\u00f3n mayor o igual a 10.2.13\n\nConsulte las notas de la versi\u00f3n ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). Puede descargar la \u00faltima versi\u00f3n de Confluence Data Center y Server desde el centro de descargas ([https://www.atlassian.com/software/confluence/download-archives]).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa Bug Bounty."}], "id": "CVE-2026-21580", "lastModified": "2026-11-09T20:10:00.200", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@atlassian.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21580", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T03:55:22.938181Z", "version": "2.0.3"}}]}, "published": "2026-08-18T22:16:50.140", "references": [{"source": "security@atlassian.com", "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768"}, {"source": "security@atlassian.com", "url": "https://jira.atlassian.com/browse/CONFSERVER-104381"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.2.0,10.2.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.1.0,10.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.2,10.0.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.5.1,9.5.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.4.0,9.4.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.3.1,9.3.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.2.0,9.2.20]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.1.0,9.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "9.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.9.6,8.9.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.15,8.5.31]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.19.27,7.19.30]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[10.2.13,10.2.15]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[9.2.21,9.2.23]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Confluence Data Center", "source": "cna", "vendor": "Atlassian"}, "product": "confluence_data_center", "vendor": "atlassian"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.15,8.5.31]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.19.27,7.19.30]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Confluence Server", "source": "cna", "vendor": "Atlassian"}, "product": "confluence_server", "vendor": "atlassian"}], "created": "2026-08-19T08:45:03.857697+00:00", "title": "Stored XSS, Privilege Escalation, and Security Misconfiguration in Atlassian Confluence", "updated": "2026-08-19T11:00:04.169866+00:00", "vendors": ["atlassian", "atlassian$PRODUCT$confluence_data_center", "atlassian$PRODUCT$confluence_server"], "weaknesses": ["CWE-79", "CWE-269", "CWE-710"]}