Detections
Analytics
Atlassian Confluence < 9.2.24 Multiple Vulnerabilities
critical Web App Scanning Plugin ID 115689
Language:
Synopsis
Atlassian Confluence < 9.2.24 Multiple VulnerabilitiesDescription
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 9.2.24 or 9.3.x prior to 10.2.17. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :- Multiple man-in-the-middle vulnerabilities in the bundled Netty dependency. (CVE-2026-45674, CVE-2026-47691)
- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)
- An injection vulnerability in the bundled Bouncy Castle dependency. (CVE-2026-59650)
- Multiple broken authentication and session management vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-8763, CVE-2026-12803, CVE-2026-12802, CVE-2026-59642, CVE-2026-59639, CVE-2026-12816)
- Multiple broken authentication and session management vulnerabilities in the bundled Apache Tomcat dependency. (CVE-2026-55276, CVE-2026-53404)
- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-56745, CVE-2026-59901, CVE-2026-48043, CVE-2026-45416, CVE-2026-73507, CVE-2026-56819, CVE-2026-55833, CVE-2026-55831)
- Multiple denial of service vulnerabilities in the bundled Immutable.js dependency. (CVE-2026-59880, CVE-2026-59879)
- Multiple denial of service vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-13506, CVE-2026-58059)
- Multiple remote code execution vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-14682, CVE-2026-58060)
- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)
- A denial of service vulnerability in the bundled node-tar dependency. (CVE-2026-73566)
- A broken authentication and session management vulnerability in the bundled Netty dependency. (CVE-2026-50010)
- A cross-site request forgery (CSRF) vulnerability in the bundled nanoid dependency. (CVE-2026-73086)
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Atlassian Confluence version 9.2.24 or later.See Also
https://confluence.atlassian.com/security/security-bulletin-september-15-2026-1822852209.html
Plugin Details
Severity: Critical
ID: 115689
Type: Version Based
Family: Component Vulnerability
Published: 10/16/2026
Updated: 10/16/2026
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 5.7
Percentile: 96.29
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-4800
CVSS v3
Risk Factor: Critical
Base Score: 10
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS Score Source: CVE-2026-45674
CVSS v4
Risk Factor: Critical
Base Score: 9.3
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-59650
Vulnerability Information
CPE: cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/15/2026
Vulnerability Publication Date: 3/30/2026
Reference Information
CVE: CVE-2026-12802, CVE-2026-12803, CVE-2026-12816, CVE-2026-13506, CVE-2026-14682, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-4800, CVE-2026-48043, CVE-2026-50010, CVE-2026-53404, CVE-2026-55276, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56819, CVE-2026-58059, CVE-2026-58060, CVE-2026-59639, CVE-2026-59642, CVE-2026-59650, CVE-2026-59879, CVE-2026-59880, CVE-2026-59901, CVE-2026-73086, CVE-2026-73507, CVE-2026-73566, CVE-2026-8763
CWE: 1241, 1284, 1285, 1287, 190, 20, 284, 285, 287, 295, 300, 345, 346, 347, 352, 354, 358, 400, 401, 407, 409, 670, 674, 697, 74, 770, 772, 778, 789, 835, 94
OWASP: 2010-A1, 2010-A3, 2010-A4, 2010-A5, 2010-A6, 2010-A7, 2010-A8, 2010-A9, 2013-A1, 2013-A2, 2013-A4, 2013-A5, 2013-A6, 2013-A7, 2013-A8, 2013-A9, 2017-A1, 2017-A10, 2017-A2, 2017-A3, 2017-A5, 2017-A6, 2017-A9, 2021-A1, 2021-A2, 2021-A3, 2021-A6, 2021-A7, 2021-A8, 2021-A9, 2025-A1, 2025-A10, 2025-A4, 2025-A5, 2025-A6, 2025-A7, 2025-A8, 2025-A9
WASC: Application Misconfiguration, Buffer Overflow, Credential/Session Prediction, Cross-Site Request Forgery, Denial of Service, Improper Input Handling, Insufficient Authentication, Insufficient Authorization, Insufficient Transport Layer Protection, Integer Overflows, OS Commanding
CAPEC: 1, 10, 101, 104, 108, 109, 110, 111, 114, 115, 120, 125, 127, 13, 130, 135, 136, 14, 141, 142, 147, 148, 151, 153, 160, 17, 182, 19, 194, 197, 209, 21, 218, 22, 229, 23, 230, 231, 24, 242, 250, 261, 267, 273, 28, 3, 31, 34, 35, 384, 385, 386, 387, 388, 39, 402, 42, 43, 441, 45, 459, 46, 462, 463, 467, 469, 47, 473, 475, 478, 479, 482, 486, 487, 488, 489, 490, 491, 492, 493, 494, 495, 496, 5, 502, 503, 51, 510, 52, 528, 53, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 57, 578, 588, 59, 593, 6, 60, 62, 63, 633, 64, 647, 650, 668, 67, 7, 71, 72, 73, 75, 76, 77, 78, 79, 8, 80, 81, 83, 84, 85, 87, 88, 89, 9, 92, 94
DISA STIG: APSC-DV-000460, APSC-DV-000500, APSC-DV-001810, APSC-DV-002250, APSC-DV-002400, APSC-DV-002440, APSC-DV-002500, APSC-DV-002510, APSC-DV-002560, APSC-DV-002590, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i), 164.312(b)
ISO: 27001-A.10.1, 27001-A.10.1.2, 27001-A.12.4.1, 27001-A.12.6.1, 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.2.1, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-AU-12, sp800_53-AU-2, sp800_53-CM-6b, sp800_53-IA-2(8), sp800_53-SC-12, sp800_53-SC-24, sp800_53-SC-5, sp800_53-SI-10, sp800_53-SI-10(5), sp800_53-SI-16
OWASP API: 2019-API10, 2019-API2, 2019-API7, 2019-API8, 2023-API2, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-14.2.1, 4.0.2-14.4.7, 4.0.2-3.2.1, 4.0.2-3.5.3, 4.0.2-4.1.3, 4.0.2-4.2.2, 4.0.2-5.1.3, 4.0.2-5.2.5, 4.0.2-7.2.1, 4.0.2-9.2.1
PCI-DSS: 3.2-10.2, 3.2-2.2, 3.2-6.2, 3.2-6.5, 3.2-6.5.1, 3.2-6.5.10, 3.2-6.5.2, 3.2-6.5.4, 3.2-6.5.8, 3.2-6.5.9