CVE-2026-21580: Confluence Stored XSS Vulnerability

CVE-2026-21580 Overview

CVE-2026-21580 is a stored Cross-Site Scripting (XSS) vulnerability in Atlassian Confluence Data Center and Server that also enables privilege escalation and exploitation of security misconfiguration. An unauthenticated remote attacker can inject persistent HTML or JavaScript that executes in the browsers of other users, including administrators. Successful exploitation allows the attacker to perform actions as a higher-privileged user and pivot deeper into the Confluence instance through overlooked security controls.

Atlassian confirmed the flaw was reported through its Bug Bounty program. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An unauthenticated attacker can execute arbitrary scripts in victim browsers, hijack administrator sessions, and escalate privileges on Confluence Data Center and Server instances.

Affected Products

Confluence Data Center and Server versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, and 7.19.0
Confluence Data Center and Server versions 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, and 9.5.1
Confluence Data Center and Server versions 10.0.2, 10.1.0, and 10.2.0

Discovery Timeline

2026-08-18 - CVE-2026-21580 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-21580

Vulnerability Analysis

CVE-2026-21580 combines three weaknesses in Confluence Data Center and Server: stored XSS, privilege escalation, and security misconfiguration. The stored XSS component allows an unauthenticated attacker to place malicious HTML or JavaScript into Confluence content that renders later in another user's browser session. When a higher-privileged user, such as a space administrator or system administrator, views the poisoned content, the injected script executes with that user's authenticated context.

This execution context is what turns a content-injection bug into a privilege escalation. Injected script can invoke privileged Confluence REST endpoints, modify user or group permissions, create administrator accounts, or exfiltrate session tokens. The additional security misconfiguration element lets attackers reach or influence functionality that best-practice hardening would normally block.

Root Cause

The root cause is improper neutralization of user-supplied input before it is stored and rendered in the Confluence web UI (CWE-79). Content submitted by unauthenticated requests is persisted without sufficient sanitization or output encoding, and downstream renderers do not enforce a strict content security policy that would block inline script execution.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond a target browsing affected content. An attacker submits crafted payload data to a vulnerable Confluence endpoint, and the payload persists in the instance. When any authenticated user loads that content, the browser executes the attacker's script under the user's session, enabling actions ranging from data theft to full administrative takeover.

No public proof-of-concept is available at this time. Technical details are tracked in the Atlassian advisory and Jira issue CONFSERVER-104381.

Detection Methods for CVE-2026-21580

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload) stored in Confluence pages, comments, macros, or space descriptions.
Anonymous or low-privileged accounts submitting POST requests to Confluence content APIs shortly before administrator sessions execute unexpected privileged API calls.
Creation of new administrator accounts or group membership changes not tied to a legitimate change ticket.

Detection Strategies

Search the Confluence database and content export for HTML tags and JavaScript URI schemes in fields that should contain plain text or sanitized markup.
Correlate web access logs with audit logs to identify sequences where anonymous content submission is followed by privileged actions from an administrator's IP or session.
Deploy Web Application Firewall (WAF) rules that inspect Confluence request bodies for script injection patterns and alert on matches.

Monitoring Recommendations

Enable and forward Confluence audit logs, access logs, and Tomcat request logs to a centralized logging platform for retention and analysis.
Alert on any change to confluence-administrators group membership, permission scheme modifications, and user-macro creation.
Monitor outbound network connections from user browsers on the Confluence domain to unfamiliar hosts, which may indicate script-driven data exfiltration.

How to Mitigate CVE-2026-21580

Immediate Actions Required

Upgrade Confluence Data Center and Server to the latest supported release as recommended by Atlassian.
If running the 9.2.x branch, upgrade to 9.2.21 or later; if running the 10.2.x branch, upgrade to 10.2.13 or later.
Review recently created or modified pages, macros, and user accounts on any instance running an affected version prior to patching.
Rotate administrator credentials and invalidate active sessions after patching to remove any tokens captured through the vulnerability.

Patch Information

Atlassian has released fixed versions of Confluence Data Center and Server. Refer to the Confluence release notes for the full list of remediated builds and download the current release from the Atlassian download archives. The official vendor advisory for this issue is published on the Atlassian Confluence advisory page.

Workarounds

Atlassian has not published a supported workaround; upgrading to a fixed version is the required remediation path.
Where immediate patching is not possible, restrict network access to the Confluence instance to trusted networks and VPN users to reduce unauthenticated exposure.
Deploy a WAF in front of Confluence with rules that block requests containing common XSS payload patterns until the upgrade is completed.

bash

# Verify installed Confluence version before and after upgrade
curl -s https://<confluence-host>/rest/applinks/1.0/manifest \
  | grep -Eo '<version>[^<]+</version>'

# Example: restrict inbound access to Confluence via iptables
iptables -A INPUT -p tcp --dport 8090 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8090 -j DROP