Confluence Data Center has a 9.3 code execution flaw via its old SOAP API

Confluence Data Center has a 9.3 code execution flaw via its old SOAP API

10 November 2026: Atlassian has rated a remote code execution flaw in Confluence Data Center critical, 9.3 on CVSS 4.0, and released 9.2.28 to fix it; the flaw lives in Apache Axis, the third-party library behind Confluence's XML-RPC and SOAP interfaces. Only instances with the Remote API switched on are exposed, which narrows the target but also points straight at the older, heavily scripted installations most likely to have it on.

Not yet independently verified. The rating is Atlassian's own internal assessment and it cannot say whether instances have been compromised; INCIBE-CERT reported no exploitation when it listed the flaw, and we found no other independent confirmation. We will update this when it can be confirmed, and remove this note.

Who is exposed

Atlassian's advisory, released on 9 November at 22:00 Pacific time, says Apache Axis has published a critical vulnerability allowing remote code execution and that Confluence uses the library for its XML-RPC and SOAP APIs. Its vector string, AV:N/AC:L/PR:N/UI:N, describes an attack over the network with no privileges and no user action. To be vulnerable, the "Remote API (XML-RPC & SOAP)" setting must be enabled. Atlassian turned it off by default for new installations from Confluence 3.0 and removed the feature entirely in Confluence 10.0, so 10.x and later are not affected, and nor is Atlassian Cloud. Confluence Data Center from 1.x to 9.x is.

The fixed release is 9.2.28, the long-term support build, or the latest version. Atlassian says it cannot confirm whether any instance has been hit and tells customers to have their security teams check affected sites for signs of compromise.

Switching the API off without a restart

Where an upgrade cannot happen at once, Atlassian's mitigation is to untick "Remote API (XML-RPC & SOAP)" under General Configuration, Further Configuration, and save. The setting takes effect immediately, with no restart. To check it worked, the SOAP endpoint at /plugins/servlet/soap-axis1/confluenceservice-v2 under the site's base URL should return 403.

The catch is the reason the API is still on in the first place. Atlassian warns that turning it off may stop scripts, automations and third-party add-ons that use it, and suggests testing in a non-production environment first. Teams that still drive Confluence through XML-RPC, typically old publishing or migration scripts, have to choose between those and exposure until 9.2.28 is in.

A wider push off the 9.x line

The flaw lands as Atlassian moves Data Center customers towards Confluence 10, where the legacy Remote API no longer exists. For an organisation still on 9.x with scripts built on XML-RPC, the upgrade to 9.2.28 buys time, but the integration will have to move to the REST API either way when it leaves the 9.x line.

Related on TrustList:

• Nextcloud's built-in Collabora server flaw was exploited before disclosure
• SharePoint Server CVE-2026-65660 and WordPress CVE-2026-87902 are now exploited: check the August SharePoint update and WordPress 7.1.2

Sources

• Atlassian: CVE-2026-90436, Remote Code Execution in Confluence Data Center, 10 November 2026
• INCIBE-CERT: Ejecucion remota de codigo en Confluence Data Center de Atlassian (INCIBE-2026-848), 11 November 2026