CVE-2026-21580

Executive Summary

CVE-2026-21580 is a Critical-severity vulnerability in Atlassian Confluence Data Center and Server affecting versions 7.1.1 through 10.2.x. The flaw combines Stored Cross-Site Scripting (XSS), Privilege Escalation, and Security Misconfiguration vectors, allowing an unauthenticated attacker to execute arbitrary HTML/JavaScript in victims' browsers, perform actions as higher-privileged users, and exploit systems through overlooked security best practices. The vulnerability carries a CVSS score of 8.6 and impacts a wide range of widely deployed Confluence instances, with fixed releases available in Confluence 9.2.21 and 10.2.13.

Technical Analysis

The CVE description indicates a tripartite vulnerability profile affecting Atlassian Confluence Data Center and Server. The three components work in concert to enable comprehensive compromise:

Stored XSS Component: The vulnerability allows an unauthenticated attacker to inject and persist arbitrary HTML or JavaScript code that executes in the context of a victim's browser session. Because Confluence is a collaboration platform where content is routinely viewed by multiple users, Stored XSS payloads can propagate across an entire organization. The injected content persists on the server, meaning every subsequent view by any user triggers execution — a property that significantly amplifies the impact beyond a single victim.

Privilege Escalation Component: The description indicates the attacker can "perform actions as a higher-privileged user." This suggests a flaw in the authorization/authentication logic that permits an unauthenticated attacker to escalate privileges. The mechanism is not detailed in the provided data, but the privilege escalation likely operates in conjunction with the XSS to steal session tokens, CSRF tokens, or administrative credentials, or may exist as an independent authentication bypass vector.

Security Misconfiguration Component: The vulnerability class explicitly references "loopholes exposed from security best-practices being overlooked." This implies that certain default configurations, permissive access control lists, exposed administrative endpoints, or misconfigured authentication mechanisms in Confluence contribute to or amplify the exploitability. This component widens the attack surface, potentially allowing the attacker to pivot from the XSS/PrivEsc payload into deeper system access.

The vulnerability was introduced across a broad spectrum of versions (7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0), suggesting the flaw was introduced early and propagated through multiple release branches. The Critial severity (CVSS 8.6) reflects the combination of low complexity of exploitation, high impact on confidentiality, integrity, and availability, and the fact that no authentication is required to trigger the initial XSS vector.

Insufficient technical detail is available in the NVD description to identify specific endpoints, parameters, or functions involved in the vulnerability. The attack mechanism must be understood at the vulnerability-class level: the Stored XSS is delivered through some content submission channel, the privilege escalation bypasses Confluence's authorization checks, and the security misconfiguration provides a path for the attacker to obtain system-level access beyond the web application layer.

Exploitation Scenarios

Based strictly on the vulnerability classes described, the likely attack chain is as follows:

Step 1: Reconnaissance/Identification. The attacker identifies exposed Confluence instances via internet-wide scanning, using dork queries such as title:"Confluence" or http.html:"Atlassian Confluence". The attacker fingerprints the exact version by accessing the login page footer, /login.action, or version disclosure endpoints. Target selection prioritizes unpatched versions (7.1.1 through 10.2.x, excluding fixed versions).

Step 2: Flaw Trigger (Stored XSS Injection). As an unauthenticated attacker, the compromise begins by submitting a crafted payload through a Confluence content submission mechanism — for example, creating a page, blog post, comment, or manipulating user-controlled fields that are subsequently rendered to other users. The XSS payload consists of embedded JavaScript or HTML that evades input sanitization and is stored server-side. When an authenticated user (particularly an administrator) views the page containing the payload, the script executes in their browser session.

Step 3: Payload Execution/Privilege Escalation. The stored XSS payload hijacks the victim's session, exfiltrating session cookies and CSRF tokens. Using the victim's privileged context, the attacker triggers the privilege escalation vector to perform administrative actions — creating backdoor accounts, modifying global configurations, or disabling security controls. The security misconfiguration component is then leveraged to pivot from the web-tier compromise to underlying system access, potentially exploiting exposed administrative interfaces, debug endpoints, or misconfigured file storage that Confluence should have protected.

Step 4: Post-Exploitation Impact. With administrative rights in Confluence and potential OS-level access, the attacker can exfiltrate all wiki data (including credentials, internal documentation, and secrets), deploy web shells, establish persistent access, use the compromised server as a pivot point into the internal network, and potentially launch further attacks against connected Atlassian products (Jira, Bitbucket, Crowd) that share authentication infrastructure.

No public PoC is available at the time of writing; the attack chain is inferred from vulnerability class and the CVE description. Organizations should treat this as an actively exploitable risk given the Critical rating.

Impact Assessment

The business impact of CVE-2026-21580 is severe across multiple dimensions:

Confidentiality Impact (High): An attacker can read any Confluence content, extract credentials, access restricted spaces, and exfiltrate sensitive corporate knowledge stored in the wiki. Confluence often functions as the corporate knowledge base containing architecture diagrams, credentials, incident reports, and internal processes.

Integrity Impact (High): The attacker can modify pages, plant malicious content for future victims (watering-hole style attacks on internal users), alter configuration settings, and implant persistent backdoors. Privilege escalation allows changes that survive for extended periods undetected.

Availability Impact (High): With administrative access, the attacker can force logouts, delete spaces or pages, lock out legitimate users, or render the instance inoperable.

Affected Systems: All Confluence Data Center and Server installations running versions 7.1.1 through 10.2.x. This includes both on-premises and self-hosted deployments; Atlassian Cloud customers are not affected (the CVE references Data Center and Server specifically). Organizations with exposed unpatched instances are at highest risk. Given Confluence's role in DevOps environments where it often has reach to CI/CD pipelines, source code repositories, and monitoring systems, the blast radius can extend to the entire software delivery chain.

Exploitation in the Wild: No evidence of public exploit code or active exploitation is confirmed at the time of writing (CISA KEV: NO). However, Atlassian products are prime targets for APT groups and ransomware operators, and the Bug Bounty disclosure path suggests the vulnerability was discovered through coordinated research rather than active exploitation. Ransomware groups have historically weaponized Confluence vulnerabilities within days of disclosure.

Detection Guidance

Sigma Rule

title: CVE-2026-21580 - Atlassian Confluence Stored XSS Privilege Escalation Attempt
id: f4a1c2d3-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation attempts of CVE-2026-21580, a Stored XSS, Privilege Escalation, and Security Misconfiguration vulnerability in Atlassian Confluence Data Center and Server
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
  product: confluence
  category: webserver
detection:
  selection_xss_payloads:
    cs-method: POST
    cs-uri-query|contains:
      - 'createverd'
      - 'dosearch'
      - 'insert'
    cs-body|contains:
      - '<script>'
      - '<img'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  selection_unusual_admin:
    cs-uri-query|contains:
      - '/admin/'
      - '/console/'
      - '/setup/'
    cs-user-agent|contains:
      - 'curl'
      - 'wget'
      - 'python-requests'
  selection_suspicious_status:
    sc-status:
      - 200
      - 302
  condition: selection_xss_payloads or (selection_unusual_admin and selection_suspicious_status)
  timeframe: 10m
level: high
tags:
  - attack.t1190
  - attack.t1059.007
  - cve.2026.21580

YARA Rule

rule CVE_2026_21580_Confluence_Stored_XSS_Payloads
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Stored XSS payloads used in exploitation of CVE-2026-21580 in Atlassian Confluence"
        date = "2026-02-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-21580"
        severity = "critical"
    strings:
        $xss1 = "<script>" ascii wide
        $xss2 = "javascript:" ascii wide
        $xss3 = "onerror=" ascii wide
        $xss4 = "onload=" ascii wide
        $xss5 = "<iframe" ascii wide
        $xss6 = "document.cookie" ascii wide
        $xss7 = "fetch(" ascii wide
        $xss8 = "XMLHttpRequest" ascii wide
        $xss9 = "eval(" ascii wide nocase
        $priv1 = "adminpermissions" ascii wide nocase
        $priv2 = "privilege" ascii wide nocase
        $priv3 = "group" ascii wide nocase
        $pivot1 = "cmd" ascii wide
        $pivot2 = "/etc/passwd" ascii wide
        $pivot3 = "exec(" ascii wide nocase
    condition:
        uint16(0) == 0x3C21 and  // HTML/XML document
        2 of ($xss*) and
        (1 of ($priv*) or 1 of ($pivot*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-21580 - Confluence Stored XSS Injection Attempt via Content Submission"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/createpage"; nocase; content:"/createverd"; nocase; pcre:"/<script[\s>]|javascript:|onerror=|onload=/i"; classtype:web-application-attack; reference:cve,2026-21580; sid:20260215801; rev:1;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-21580 - Confluence Privilege Escalation via Unauthenticated Admin Access"; flow:established,to_server; http.uri; content:"/admin/"; nocase; http.uri; content:"/setup/"; nocase; http.uri; content:"/console/"; nocase; http.method; content:"GET"; http.user_agent; content:"curl"; nocase; threshold:type both, track by_src, count 5, seconds 300; classtype:attempted-admin; reference:cve,2026-21580; sid:20260215802; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-21580 - Confluence Data Exfiltration - Cookie/Sensitive Data Beaconing"; flow:established,to_client; http.response_body; content:"document.cookie"; nocase; content:"location.href"; nocase; pcre:"/(https?:\/\/|fetch\(|XMLHttpRequest)[^\s]{20,}/i"; classtype:policy-violation; reference:cve,2026-21580; sid:20260215803; rev:1;)

Elastic Detection

/**
 * Detect Stored XSS payload injection attempts against Confluence (CVE-2026-21580)
 * Detects POST requests to Confluence content endpoints containing script markers
 */
sequence by host.name with maxspan=10m
  [ network where
    event.category == "network" and
    network.protocol == "http" and
    http.request.method == "POST" and
    url.path like "*Confluence*" or url.path like "*/createpage*" or url.path like "*confluence*" and
    http.request.body.content matches "<script>" or
    http.request.body.content matches "javascript:" or
    http.request.body.content matches "onerror=" or
    http.request.body.content matches "onload=" ]
  [ network where
    event.category == "network" and
    network.protocol == "http" and
    http.request.method == "POST" and
    url.path like "*confluence*" and
    url.path like "*admin*" ]

Splunk SPL Query

index=web sourcetype=access_combined_w3c cs_uri_stem="*confluence*" (cs_uri_stem="*createpage*" OR cs_uri_stem="*createverd*" OR cs_uri_stem="*dosearch*")
| rex field=_raw "cs_body\"?=(?<body>.*)"
| search body="*<script>*" OR body="*javascript:*" OR body="*onerror=*" OR body="*onload=*" OR body="*<iframe*"
| eval xss_detected=if(match(body, "(?i)<script|javascript:|onerror=|onload=|<iframe"), "true", "false")
| where xss_detected="true"
| eval severity="CRITICAL", cve="CVE-2026-21580", vulnerability="Confluence Stored XSS + PrivEsc"
| stats count by src_ip, cs_uri_stem, c_ip, user_agent, severity, cve, vulnerability, _time
| sort - _time
| table _time, src_ip, cs_uri_stem, user_agent, count, severity, cve, vulnerability

index=web sourcetype=access_combined_w3c cs_uri_stem="*confluence*" (cs_uri_stem="*/admin/*" OR cs_uri_stem="*/setup/*" OR cs_uri_stem="*/console/*")
| search (user_agent="*curl*" OR user_agent="*wget*")
| eval privileged_access_attempt=if((method="GET" AND status=200), "true", "false")
| where privileged_access_attempt="true"
| eval severity="HIGH", cve="CVE-2026-21580", vulnerability="Unauthenticated Privilege Escalation Attempt"
| stats count by src_ip, cs_uri_stem, user_agent, severity, cve, vulnerability
| sort - count
| table _time, src_ip, cs_uri_stem, user_agent, count, severity, cve, vulnerability

Wazuh OSSEC Rule

<group name="confluence,">
  <!-- CVE-2026-21580: Stored XSS payloads in Confluence content submission -->
  <rule id="298275" level="14">
    <decoded_as>json</decoded_as>
    <field name="event_type">http</field>
    <field name="http.http_method">POST</field>
    <regex>http.http_uri.*(confluence|createpage)</regex>
    <regex>http.http_body.*(&lt;script|javascript:|onerror=|onload=|&lt;iframe)</regex>
    <description>CVE-2026-21580: Stored XSS payload detected in Confluence content submission</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attck.execution,attck.initial_access,</group>
  </rule>

  <!-- CVE-2026-21580: Unauthenticated access attempts to Confluence admin/setup endpoints -->
  <rule id="298276" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">http</field>
    <regex>http.http_uri.*(confluence)\/(admin|setup|console)</regex>
    <regex>http.http_user_agent.*(curl|wget|python)</regex>
    <description>CVE-2026-21580: Unauthenticated Confluence admin endpoint access attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attck.initial_access,</group>
  </rule>

  <!-- CVE-2026-21580: Outbound data exfiltration from Confluence server -->
  <rule id="298277" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">http</field>
    <regex>http.http_response_body.*(document.cookie|fetch\(|XMLHttpRequest)</regex>
    <description>CVE-2026-21580: Potential XSS-driven data exfiltration from Confluence</description>
    <group>attck.collection,attck.exfiltration,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. While the CVE description references fixed versions (9.2.21 and 10.2.13), no independent patch evidence has been confirmed through the tracked patch sources. Organizations must verify the availability and integrity of the vendor fix before deployment.

Immediate Mitigations (if patching is not immediately possible):

1. Restrict network access: Place Confluence behind a VPN/WAF and restrict access to trusted IP ranges. Disable anonymous access to content creation features.
2. Enable aggressive input validation: Deploy a Web Application Firewall (WAF) with OWASP Core Rule Set to block XSS payload patterns.
3. Disable public registration: If user self-registration is enabled, disable it to reduce attack surface.
4. Harden session management: Enable HTTPOnly, Secure, and SameSite attributes for all session cookies to reduce XSS impact.
5. Enforce MFA: Require multi-factor authentication for all administrative accounts to mitigate privilege escalation impact.
6. Monitor logs: Implement the detection rules above and alert on any suspicious activity.

Patch/Upgrade Steps:

1. Verify current Confluence version via Administration → System Info.
2. If on 9.2.x, upgrade to ≥ 9.2.21. If on 10.2.x, upgrade to ≥ 10.2.13.
3. For other versions, upgrade to the latest supported release matching your deployment model (Data Center or Server).
4. Download from the official Atlassian download center: https://www.atlassian.com/software/confluence/download-archives
5. Follow the official upgrade guide, take full backups, and validate in a staging environment first.
6. After upgrade, verify the fix by reviewing release notes: https://confluence.atlassian.com/doc/confluence-release-notes-327.html

Long-Term Hardening:

1. Maintain a patch cadence — Atlassian releases security fixes frequently; establish a 15-day patch SLA for Critical vulnerabilities.
2. Implement network segmentation for Confluence so it cannot reach CI/CD systems or internal databases.
3. Review Confluence security configuration comprehensively — address all security best-practices gaps that the CVE description references (e.g., exposed debug endpoints, permissive access control).
4. Deploy continuous vulnerability scanning (e.g., Tenable, Qualys) targeting what remains the most targeted group of enterprise web applications.
5. Implement a server-side CSP (Content-Security-Policy) header to mitigate XSS even if injection occurs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-21580
2. Atlassian Confluence Release Notes: https://confluence.atlassian.com/doc/confluence-release-notes-327.html
3. Atlassian Download Center: https://www.atlassian.com/software/confluence/download-archives
4. CISA Known Exploited Vulnerabilities Catalog (confirmed: Not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Atlassian Security Advisory Portal: https://www.atlassian.com/trust/security/security-advisories

Threat Actor Campaign Notes: No public evidence of exploitation in the wild or active threat actor campaigns has been confirmed at the time of writing. However, given Atlassian's status as a high-value target for ransomware groups (e.g., Cl0p's systematic exploitation of Confluence CVEs) and espionage groups, organizations should treat this vulnerability as an elevated risk and prioritize patching. Vulnerability disclosure via Bug Bounty programs often precedes weaponization within 30-60 days.