CVE-2026-90436, Atlassian Confluence Data Center 1.x to 9.x: remote code execution through the bundled Apache Axis behind the Remote API (XML-RPC and SOAP) when that API is enabled; fixed in 9.2.28, Confluence 10 not affected (CVSS 4.0 9.3)

Atlassian's advisory of 2026-11-09 says Confluence uses the third-party library Apache Axis in its XML-RPC and SOAP APIs and that Apache Axis has published a critical vulnerability, CVE-2026-90436, that allows remote code execution (Atlassian, 2026-11-09). A Confluence Data Center instance is vulnerable only if the "Remote API (XML-RPC & SOAP)" setting is enabled; the setting has been off by default for new installations since Confluence 3.0 and the feature was removed in Confluence 10.0, so 10.x is not affected, nor is Confluence Cloud (Atlassian, 2026-11-09). Atlassian scores the flaw 9.3 (CVSS 4.0, network vector, no privileges, no user interaction), lists Confluence Data Center 1.x to 9.x as affected and 9.2.28 as the fixed version (Atlassian, 2026-11-09). If patching must wait, clearing the Remote API checkbox needs no restart, and a request to the soap-axis1 confluenceservice-v2 servlet path should then answer HTTP 403. Atlassian says it "cannot confirm if your instances have been affected" and asks teams to check affected instances for compromise (Atlassian, 2026-11-09); no source reports exploitation, and BSI CERT-Bund's bulletin rates the issue high (BSI CERT-Bund, 2026-11-10).