# CVE-2026-21579: Atlassian Confluence Data Center information disclosure

Source: https://junglewise.ai/threats/cve-2026-21579-atlassian-confluence-data-center-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-21579 · Severity: info · CVSS 8.2 · Published 2026-07-21

Atlassian Confluence Data Center, a popular team collaboration and document management platform, is affected by a high-severity security flaw. This vulnerability allows an unauthorized person to access sensitive internal information without needing a username or password. Such an exploit could lead to the exposure of proprietary business data or internal documentation, potentially impacting corporate confidentiality and compliance.

Technologies: [Atlassian Confluence Data Center](https://junglewise.ai/threats/technologies/confluence-data-center). Vendors: [Atlassian](https://junglewise.ai/threats/vendors/atlassian).

## Quick answers

**Is CVE-2026-21579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21579 being exploited in the wild.

**How severe is CVE-2026-21579?** Informational severity, with a CVSS score of 8.2, published 21 July 2026.

**Which products and versions are affected?** Atlassian Confluence Data Center 7.17.0 to 10.2.13.

**Is there a fix for CVE-2026-21579?** A patch was published on 2026-07-21: Fixed versions 9.2.22 and 10.2.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21579 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-21579?** Check whether you run Atlassian Confluence Data Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Atlassian Confluence Data Center across multiple version branches, including 7.x, 8.x, 9.x, and 10.x. The flaw allows a remote, unauthenticated attacker to view sensitive information due to improper access controls or data handling. According to the CVSS:4.0 vector, the attack is network-based, requires low technical complexity, and involves no user interaction, though it may require specific environmental conditions (Attack Terminology: P). Successful exploitation results in high confidentiality impact. Atlassian has released patches in versions 9.2.22 and 10.2.14 to address this issue.

## Affected products

- Atlassian Confluence Data Center 7.17.0 to 10.2.13

## Timeline

- 2026-07-09: other: Vulnerability record created in Atlassian Jira
- 2026-07-21: disclosed: Initial advisory publication
- 2026-07-21: patched: Fixed versions 9.2.22 and 10.2.14 released

## References

- [https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345](https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345)
- [https://jira.atlassian.com/browse/CONFSERVER-104340](https://jira.atlassian.com/browse/CONFSERVER-104340)

## Related threats

- [Atlassian Data Center arbitrary file access without authentication](https://junglewise.ai/threats/cve-2026-21589-h3-summary-this-is-a-vulnerability-in-bitbucket-data-center)
- [Atlassian Confluence Data Center DoS in authenticated request handling](https://junglewise.ai/threats/cve-2026-21588-atlassian-confluence-data-center-dos-in-authenticated-request)
- [Atlassian Confluence Data Center improper authorization](https://junglewise.ai/threats/cve-2026-21586-atlassian-confluence-data-center-improper-authorization)
- [Atlassian Confluence Data Center denial of service](https://junglewise.ai/threats/cve-2026-21577-atlassian-confluence-data-center-denial-of-service)
- [Atlassian Confluence Data Center and Server Template Injection Vulnerability](https://junglewise.ai/threats/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection)