AtlassianAnalysisAtlassian patches critical Confluence Data Center remote code execution vulnerability
What happened.Atlassian published security advisory CONFSERVER-104610 resolving an unauthenticated remote code execution vulnerability affecting Confluence Data Center deployments.
Why it matters.Confluence Data Center hosts proprietary design documents and internal engineering wikis for enterprise teams. When unauthenticated SOAP requests trigger class deserialization and remote code execution, attackers compromise application servers. Infrastructure engineers should upgrade Confluence Data Center instances immediately and disable legacy XML-RPC endpoints.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-90436, the defect stems from unsafe deserialization in the Apache Axis library inside Confluence SOAP and XML-RPC interfaces.
- Attack vector: Remote unauthenticated attackers send crafted SOAP fault requests to the Remote API endpoint, instantiating arbitrary Java classes before authentication checks.
- Configuration dependency: Systems remain vulnerable when administrators enable the Remote API setting, which legacy integrations frequently activate for scripting.
- Remediation releases: Atlassian delivered fixes in Confluence Data Center versions 9.2.28, 10.2.21, and subsequent maintenance releases.
- Workaround guidance: Administrators unable to upgrade immediately can mitigate exposure by disabling the Remote API setting through the general configuration console.