Atlassian Confluence Data Center vulnerabilities

42 known vulnerabilities, 7 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Exploited Atlassian Confluence Data Center vulnerabilities

CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
CVE-2023-22527 — Atlassian Confluence Data Center and Server Template Injection Vulnerability
CVE-2023-22518 — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
CVE-2023-22515 — Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
CVE-2022-26134 — Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
CVE-2021-26085 — Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
CVE-2021-26084 — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVSS 7.5) — exploited
CVE-2026-21588 — (CVSS 7.1)
CVE-2026-21586 — (CVSS 7.1)
CVE-2026-21580 — (CVSS 9.3)
CVE-2026-21579 — (CVSS 7.5)
CVE-2026-21577 — (CVSS 6.5)
CVE-2025-22166 — (CVSS 7.5)
CVE-2024-21703 — (CVSS 6.4)
CVE-2024-21690 — (CVSS 8.2)
CVE-2024-21686 — (CVSS 8.7)
CVE-2024-21683 — (CVSS 8.8)
CVE-2024-21677 — (CVSS 8.8)
CVE-2024-21678 — (CVSS 8.5)
CVE-2023-22512 — (CVSS 7.5)
CVE-2024-21674 — (CVSS 7.5)
CVE-2024-21673 — (CVSS 8.8)
CVE-2024-21672 — (CVSS 8.8)
CVE-2023-22527 — Atlassian Confluence Data Center and Server Template Injection Vulnerability (CVSS 9.8) — exploited
CVE-2023-22526 — (CVSS 8.8)
CVE-2023-22522 — (CVSS 8.8)
CVE-2023-22518 — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (CVSS 9.8) — exploited
CVE-2023-22515 — Atlassian Confluence Data Center and Server Broken Access Control Vulnerability (CVSS 9.8) — exploited
CVE-2023-22508 — (CVSS 8.8)
CVE-2023-22505 — (CVSS 8.8)
CVE-2023-22503 — (CVSS 5.3)