Is CVE-2026-21579 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21579 being exploited in the wild.

How severe is CVE-2026-21579?

Informational severity, with a CVSS score of 8.2, published 21 July 2026.

Which products and versions are affected?

Atlassian Confluence Data Center 7.17.0 to 10.2.13.

Is there a fix for CVE-2026-21579?

A patch was published on 2026-07-21: Fixed versions 9.2.22 and 10.2.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21579 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-21579?

Check whether you run Atlassian Confluence Data Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21579: Atlassian Confluence Data Center information disclosure

CVE-2026-21579 · Severity: info · CVSS 8.2 · Published 2026-07-21

Atlassian Confluence Data Center, a popular team collaboration and document management platform, is affected by a high-severity security flaw. This vulnerability allows an unauthorized person to access sensitive internal information without needing a username or password. Such an exploit could lead to the exposure of proprietary business data or internal documentation, potentially impacting corporate confidentiality and compliance.

Technologies: Atlassian Confluence Data Center. Vendors: Atlassian.

Quick answers

Is CVE-2026-21579 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21579 being exploited in the wild.
How severe is CVE-2026-21579?: Informational severity, with a CVSS score of 8.2, published 21 July 2026.
Which products and versions are affected?: Atlassian Confluence Data Center 7.17.0 to 10.2.13.
Is there a fix for CVE-2026-21579?: A patch was published on 2026-07-21: Fixed versions 9.2.22 and 10.2.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21579 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-21579?: Check whether you run Atlassian Confluence Data Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in Atlassian Confluence Data Center across multiple version branches, including 7.x, 8.x, 9.x, and 10.x. The flaw allows a remote, unauthenticated attacker to view sensitive information due to improper access controls or data handling. According to the CVSS:4.0 vector, the attack is network-based, requires low technical complexity, and involves no user interaction, though it may require specific environmental conditions (Attack Terminology: P). Successful exploitation results in high confidentiality impact. Atlassian has released patches in versions 9.2.22 and 10.2.14 to address this issue.

Affected products

Atlassian Confluence Data Center 7.17.0 to 10.2.13

Timeline

2026-07-09: other: Vulnerability record created in Atlassian Jira
2026-07-21: disclosed: Initial advisory publication
2026-07-21: patched: Fixed versions 9.2.22 and 10.2.14 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.