CVE-2026-21579
Summary
| CVE | CVE-2026-21579 |
|---|---|
| State | PUBLISHED |
| Assigner | atlassian |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-21 18:16:57 UTC |
| Updated | 2026-07-22 19:16:59 UTC |
| Description | This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.22 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.14 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Atlassian (Internal) program. |
Risk And Classification
Primary CVSS: v4.0 8.2 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002740000 probability, percentile 0.195410000 (date 2026-07-22)
Problem Types: CWE-200 | Information Disclosure | CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 8.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Atlassian | Confluence Data Center | affected 10.2.0 to 10.2.13 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 10.1.0 to 10.1.2 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 10.0.2 to 10.0.3 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 9.2.0 to 9.2.21 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 9.1.0 to 9.1.1 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 9.0.1 to 9.0.3 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 8.9.5 to 8.9.8 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 8.5.14 to 8.5.31 | Not specified |
| CNA | Atlassian | Confluence Data Center | affected 7.19.26 to 7.19.30 | Not specified |
| CNA | Atlassian | Confluence Data Center | unaffected 10.2.14 | Not specified |
| CNA | Atlassian | Confluence Data Center | unaffected 9.2.22 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| confluence.atlassian.com/pages/viewpage.action | [email protected] | confluence.atlassian.com | |
| jira.atlassian.com/browse/CONFSERVER-104340 | [email protected] | jira.atlassian.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.