Atlassian Confluence Data Center: remote code execution via Apache Axis (CVE-2026-90436), fixed in 9.2.28
CERT-FR advisory on a remote code execution flaw in Atlassian Confluence Data Center, tracked as CVE-2026-90436. Atlassian says the bug is in Apache Axis, a third-party library that Confluence uses for its XML-RPC and SOAP APIs (confluence.atlassian.com). Exposure depends on the 'Remote API (XML-RPC & SOAP)' option being enabled, which Atlassian says has been off by default for new installations since Confluence 3.0 and was removed entirely in Confluence 10.0 (confluence.atlassian.com). The vendor rates the flaw critical at 9.3 under CVSS 4.0 with network access, low complexity, no privileges and no user interaction, based on its own assessment (confluence.atlassian.com). Atlassian reports no exploitation in the wild but says it cannot confirm whether any instance was compromised (confluence.atlassian.com). Urgency is rated high rather than critical because exploitation requires a non-default feature and no active exploitation is reported; Data Center instances with the Remote API enabled should still be treated as a priority.
Entenda a falha
A vulnerabilidade
CVE-2026-90436 is a remote code execution flaw in Atlassian Confluence Data Center, located in Apache Axis, a third-party library Confluence uses for its XML-RPC and SOAP APIs. Atlassian rates it critical, CVSS 4.0 score 9.3, with network access, low complexity, no privileges and no user interaction needed, and high impact on confidentiality, integrity and availability. It is exposed only when the 'Remote API (XML-RPC & SOAP)' option is enabled, which has been off by default for new installs since Confluence 3.0. Atlassian lists Data Center 1.x through 9.x as affected, fixed in 9.2.28 or a later fixed LTS release. 10.x (where the option was removed) and Atlassian Cloud sites are not affected.
Como funciona
The articles do not describe the internal flow in detail. What they say is that Confluence exposes its XML-RPC and SOAP APIs through the Apache Axis library, and that an unauthenticated network request to this surface can lead to arbitrary code execution on the server. The path only exists when the Remote API option is on; the vendor suggests that the axis service endpoint answering HTTP 403 confirms the feature is disabled.
Por que é vulnerável
The articles only say the bug lies in Apache Axis, a third-party component that Confluence bundles to serve its legacy Remote API. They do not give the specific root cause or describe what the fix changes in the code. The legacy feature has been off by default for new installs since 3.0 and was removed entirely in Confluence 10.0, which is why 10.x is not affected.
Onde está
The articles name the Apache Axis library and the 'Remote API (XML-RPC & SOAP)' setting (General Configuration, then Further Configuration) with its axis service endpoint, but no file, function or commit.
Como foi descoberta
The articles do not say who found the flaw or how. Atlassian published its security bulletin on 10 November 2026 and CERT-FR issued an advisory the same day. Atlassian reports no exploitation in the wild but says it cannot confirm whether any instance was compromised.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:34.
Detalhes técnicos
The vendor's CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high impact on confidentiality, integrity and availability (confluence.atlassian.com). Atlassian lists Confluence Data Center 1.x through 9.x as affected and says 10.x and later are not impacted (confluence.atlassian.com). Atlassian Cloud sites hosted on atlassian.net or jira.com are not affected (confluence.atlassian.com). The CERT-FR advisory does not give a CVSS score, vector or prerequisites.
Remediação
Upgrade Confluence Data Center to version 9.2.28 or a later fixed LTS release, as the vendor recommends (confluence.atlassian.com). If patching cannot happen immediately, disable 'Remote API (XML-RPC & SOAP)' under General Configuration, then Further Configuration, and confirm the change by checking that the axis service endpoint returns HTTP 403 (confluence.atlassian.com). The vendor warns that scripts, automations and third-party add-ons that depend on this API may stop working (confluence.atlassian.com). Check affected instances for signs of compromise, since the vendor cannot confirm this (confluence.atlassian.com).
Linha do tempo
-
Atlassian Confluence Data Center: remote code execution via Apache Axis (CVE-2026-90436), fixed in 9.2.28
ler a análise desta fonte ocultar
CERT-FR advisory on a remote code execution flaw in Atlassian Confluence Data Center, tracked as CVE-2026-90436. Atlassian says the bug is in Apache Axis, a third-party library that Confluence uses for its XML-RPC and SOAP APIs (confluence.atlassian.com). Exposure depends on the 'Remote API (XML-RPC & SOAP)' option being enabled, which Atlassian says has been off by default for new installations since Confluence 3.0 and was removed entirely in Confluence 10.0 (confluence.atlassian.com). The vendor rates the flaw critical at 9.3 under CVSS 4.0 with network access, low complexity, no privileges and no user interaction, based on its own assessment (confluence.atlassian.com). Atlassian reports no exploitation in the wild but says it cannot confirm whether any instance was compromised (confluence.atlassian.com). Urgency is rated high rather than critical because exploitation requires a non-default feature and no active exploitation is reported; Data Center instances with the Remote API enabled should still be treated as a priority.
Technical Details
The vendor's CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high impact on confidentiality, integrity and availability (confluence.atlassian.com). Atlassian lists Confluence Data Center 1.x through 9.x as affected and says 10.x and later are not impacted (confluence.atlassian.com). Atlassian Cloud sites hosted on atlassian.net or jira.com are not affected (confluence.atlassian.com). The CERT-FR advisory does not give a CVSS score, vector or prerequisites.
Remediation
Upgrade Confluence Data Center to version 9.2.28 or a later fixed LTS release, as the vendor recommends (confluence.atlassian.com). If patching cannot happen immediately, disable 'Remote API (XML-RPC & SOAP)' under General Configuration, then Further Configuration, and confirm the change by checking that the axis service endpoint returns HTTP 403 (confluence.atlassian.com). The vendor warns that scripts, automations and third-party add-ons that depend on this API may stop working (confluence.atlassian.com). Check affected instances for signs of compromise, since the vendor cannot confirm this (confluence.atlassian.com).