CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-90436, Atlassian Confluence Data Center 1.x to 9.x: remote code execution through the bundled Apache Axis behind the Remote API (XML-RPC and SOAP) when that API is enabled; fixed in 9.2.28...

cve · CVE-2026-90436 single-source

Coverage
1
first 2026-11-11 → last 2026-11-11
Latest activity
2026-11-11
Confluence Data Center: Apache Axis RCE with the Remote API on; update to 9.2.28 or disable it, check for…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-90436, newest first. Check the date before acting on an older one.

  • On every Confluence Data Center instance, open General Configuration, Further Configuration and clear the Remote API (XML-RPC & SOAP) checkbox now (no restart), confirm the soap-axis1 confluenceservice-v2 servlet path answers HTTP 403, and upgrade to 9.2.28, because Atlassian cannot confirm whether instances were affected and asks teams to check them for compromise.
    2026-11-11CVE-2026-90436

Defender insights

What each entry about CVE-2026-90436 tells a defender to do, newest first.

2026-11-11NOTABLEConfluence Data Center: Apache Axis RCE with the Remote API on; update to 9.2.28 or disable it, check for compromise

Exposure · detection

Story timeline

  1. 2026-11-11CVE-2026-90436, Atlassian Confluence Data Center 1.x to 9.x: remote code execution through the bundled Apache Axis behind the Remote API (XML-RPC and SOAP) when that API is enabled; fixed in 9.2.28, Confluence 10 not affected (CVSS 4.0 9.3)
    trending-vulnerabilitiesConfluence Data Center: Apache Axis RCE with the Remote API on; update to 9.2.28 or disable it, check for compromise

Hunting pivots

Affected products
Atlassian Confluence Data Center
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-11/confluence-dc-cve-2026-90436-apache-axis-remote-api-rce · ATT&CK page ↗

Entries about CVE-2026-90436, Atlassian Confluence Data Center 1.x to 9.x: remote code execution through the bundled Apache Axis behind the Remote API (XML-RPC and SOAP) when that API is enabled; fixed in 9.2.28... (1)

2026-11-11 · view entry permalink →

NOTABLECVE-2026-90436NATOA2

CVE-2026-90436, Atlassian Confluence Data Center 1.x to 9.x: remote code execution through the bundled Apache Axis behind the Remote API (XML-RPC and SOAP) when that API is enabled; fixed in 9.2.28, Confluence 10 not affected (CVSS 4.0 9.3)

Atlassian's advisory of 2026-11-09 says Confluence uses the third-party library Apache Axis in its XML-RPC and SOAP APIs and that Apache Axis has published a critical vulnerability, CVE-2026-90436, that allows remote code execution (Atlassian, 2026-11-09). A Confluence Data Center instance is vulnerable only if the "Remote API (XML-RPC & SOAP)" setting is enabled; the setting has been off by default for new installations since Confluence 3.0 and the feature was removed in Confluence 10.0, so 10.x is not affected, nor is Confluence Cloud (Atlassian, 2026-11-09). Atlassian scores the flaw 9.3 (CVSS 4.0, network vector, no privileges, no user interaction), lists Confluence Data Center 1.x to 9.x as affected and 9.2.28 as the fixed version (Atlassian, 2026-11-09). If patching must wait, clearing the Remote API checkbox needs no restart, and a request to the soap-axis1 confluenceservice-v2 servlet path should then answer HTTP 403. Atlassian says it "cannot confirm if your instances have been affected" and asks teams to check affected instances for compromise (Atlassian, 2026-11-09); no source reports exploitation, and BSI CERT-Bund's bulletin rates the issue high (BSI CERT-Bund, 2026-11-10).

Apache Axis has published a critical vulnerability (CVE-2026-90436) that allows remote code execution.

Atlassian cannot confirm if your instances have been affected by this vulnerability.

Atlassian
vulnerability11 Nov 03:39Zsingle-sourceOpen finding →
Sources: Atlassian (security advisory CVE-2026-90436) · BSI CERT-Bund (WID-SEC-2026-4427)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • confluence.atlassian.com1 (50%)
  • wid.cert-bund.de1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)