Confluence Data Center flaw CVE-2026-90436 lets unauthenticated attackers run code through the Remote API
The flaw sits in Apache Axis, a third-party library behind Confluence's Remote API, and the Axis project does not expect to release an Axis 1 fix.
Affects
Atlassian Confluence Data Center
What to do
Upgrade Confluence Data Center to the fixed release, and turn off the Remote API wherever it is on.
- Vendor advisory
- CVE
- CVE-2026-90436
- CVSS
- 9.3 (v4.0, Atlassian)9.8 (v3.1, CNA, via NVD)
- Exploitation
- None known
- Affected
- Atlassian Confluence Data Center
- 9.2.27 with Remote API (XML-RPC & SOAP) enabled
- Fixed in
- 9.2.28
How the flaw works
NVD's record says Axis instantiates a class named in an inbound SOAP fault before checking its type. The fault is parsed before any per-service handler runs, so authentication handlers do not protect against it.
Atlassian states that an unauthenticated attacker who can reach the instance can run commands as the Confluence operating-system account and read or alter the secrets it holds.
What to do now
Internet-facing instances with the Remote API switched on go first, because an attacker who can reach them needs no login.
- List every Confluence Data Center instance with its version, and check its administration settings for Remote API (XML-RPC & SOAP).
- Turn the setting off wherever no integration depends on it.
- Upgrade every instance to the fixed release in Atlassian's advisory, including those with the setting off.
- Where an integration needs the API, allow its endpoints only from known addresses until upgraded.
- Review reverse proxy logs for SOAP and XML-RPC requests since 6 November, when the Axis flaw was published
- If any detection sign appears, rotate the database and integration credentials Confluence holds
Who is affected
Only Confluence instances with the Remote API (XML-RPC & SOAP) setting enabled are vulnerable, Atlassian states. The setting is off by default for new installations, and Atlassian removed the feature in a later major release.
NVD's record states Axis 1 has reached end of life, so other software bundling it may carry the same flaw.
Detection notes
Atlassian states that an attacker could also modify files and disrupt the service, so check the host as well as the proxy logs.
- Requests to the SOAP or XML-RPC endpoints from addresses outside known integrations
- SOAP request bodies carrying Fault, detail and exceptionName elements
- Shells or processes started by the Confluence service account
- Changed files in the Confluence install or home directories, or unexplained service restarts
Essential Eight mapping
Patch applications: the Essential Eight Maturity Model sets 48 hours for internet-facing services when the vendor assesses a vulnerability as critical, and Atlassian rates this one critical. Restrict administrative privileges limits what injected commands can reach.
Sources
- PrimaryNVD, CVE-2026-90436 (6 November 2026)Retrieved 14 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
- SecondaryAtlassian, CONFSERVER-104610: Remote Code Execution in Confluence Data Center, CVE-2026-90436 (10 November 2026)Retrieved 14 Nov 2026
