Do Son 
TL;DR
Atlassian patched two high-severity flaws in its self-hosted products. The first, CVE-2026-21580, is a stored XSS bug in Confluence. This Confluence vulnerability scores a CVSS of 8.6 and needs no authentication.
- Product: Atlassian (2 products)
- Vulnerabilities: 2 flaws (CVE-2026-21580, CVE-2026-21582)
- Highest severity: 9.3 (Critical · CVSSv4)
- Worst impact: This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration...
- Status: No confirmed exploitation yet; patches available
- Action: Update to 10.2.13 to 10.2.15, 9.2.21 to 9.2.23, 7.2.2 to 7.2.3 now
| CVE | CVSS (CVSSv4) | Fixed in | Status |
|---|---|---|---|
| CVE-2026-21580 | 9.3 | 10.2.13 to 10.2.15, 9.2.21 to 9.2.23 | Not exploited |
| CVE-2026-21582 | 8.8 | 7.2.2 to 7.2.3 | Not exploited |
Why it matters
Confluence and Jira sit at the center of many teams’ workflows. A flaw there can expose sensitive project data. The stored XSS bug lets an attacker run code in a victim’s browser. It can also enable actions as a higher-privileged user.
How the attacks work
Stored XSS plants malicious script that the server saves and later serves. When a victim views the page, that script runs in their browser. This Confluence vulnerability then allows privilege escalation, as the Confluence advisory describes. Atlassian also links it to overlooked security best practices.
The second flaw, CVE-2026-21582, affects Jira Service Management Data Center. It is a broken authentication and session management bug scoring 8.8. An unauthenticated attacker can act as another user, per the Jira advisory.
Affected versions
The Confluence flaw affects many Data Center and Server releases, from 7.1.1 through 10.2.0. The Jira flaw affects Jira Service Management Data Center 10.3.0 and 11.3.0.
Exploitation status and patch steps
Atlassian reports no confirmed in-the-wild exploitation. Even so, update quickly. For Confluence, move to 9.2.21 or 10.2.13 or later. For Jira Service Management, upgrade to 10.3.24 or 11.3.10 or later.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
