--- schema: 1 kind: vulnerability title: "CVE-2026-90436, Atlassian Confluence Data Center 1.x to 9.x: remote code execution through the bundled Apache Axis behind the Remote API (XML-RPC and SOAP) when that API is enabled; fixed in 9.2.28, Confluence 10 not affected (CVSS 4.0 9.3)" headline: "Confluence Data Center: Apache Axis RCE with the Remote API on; update to 9.2.28 or disable it, check for compromise" summary: > Atlassian's out-of-cycle advisory of 2026-11-09 says Apache Axis, which Confluence uses for its XML-RPC and SOAP APIs, has a critical remote-code-execution flaw (CVE-2026-90436, CVSS 4.0 9.3, no privileges or user interaction), exploitable in Confluence Data Center 1.x to 9.x only when the Remote API setting is enabled, which it is not by default. The fix is 9.2.28; the workaround is to clear the Remote API checkbox without a restart; Atlassian cannot confirm whether instances were affected and asks teams to check them, and no source reports exploitation. discovered_at: "2026-11-11T03:39:30Z" updated_at: null event_date: "2026-11-09" run_id: 2026-11-11T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, pre-auth, rce, patch-available] regions: [global] sectors: [] entities: ["product:atlassian-confluence-data-center"] techniques: [T1190] affected_products: ["Atlassian Confluence Data Center"] cves: - id: CVE-2026-90436 cvss: "9.3" epss: null type: rce vector: zero-click auth: pre-auth status: [patch-available, mitigation-only] affected: "Confluence Data Center 1.x to 9.x with the Remote API (XML-RPC & SOAP) setting enabled; 10.x not affected; Cloud not affected" fixed: "9.2.28; workaround: clear the Remote API (XML-RPC & SOAP) checkbox" sources: - url: "https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-and-server-1874560038.html" publisher: "Atlassian (security advisory CVE-2026-90436)" date: "2026-11-09" role: primary - url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4427" publisher: "BSI CERT-Bund (WID-SEC-2026-4427)" date: "2026-11-10" role: corroborating closed_sources: [] evidence: - quote: "Apache Axis has published a critical vulnerability (CVE-2026-90436) that allows remote code execution." publisher: "Atlassian" source_url: "https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-and-server-1874560038.html" - quote: "Atlassian cannot confirm if your instances have been affected by this vulnerability." publisher: "Atlassian" source_url: "https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-and-server-1874560038.html" verification: single-source sourcing_note: > Atlassian's advisory carries the flaw, score, fixed version and workaround; BSI CERT-Bund lists the same advisory and is a restatement. Atlassian's advisory says nothing about exploitation and no source reports any; its request to check affected instances for compromise is a precaution the advisory does not explain. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "On every Confluence Data Center instance, open General Configuration, Further Configuration and clear the Remote API (XML-RPC & SOAP) checkbox now (no restart), confirm the soap-axis1 confluenceservice-v2 servlet path answers HTTP 403, and upgrade to 9.2.28, because Atlassian cannot confirm whether instances were affected and asks teams to check them for compromise." updates: [] migrated_from: null --- Atlassian's advisory of 2026-11-09 says Confluence uses the third-party library Apache Axis in its XML-RPC and SOAP APIs and that Apache Axis has published a critical vulnerability, CVE-2026-90436, that allows remote code execution ([Atlassian, 2026-11-09](https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-and-server-1874560038.html)). A Confluence Data Center instance is vulnerable only if the "Remote API (XML-RPC & SOAP)" setting is enabled; the setting has been off by default for new installations since Confluence 3.0 and the feature was removed in Confluence 10.0, so 10.x is not affected, nor is Confluence Cloud ([Atlassian, 2026-11-09](https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-and-server-1874560038.html)). Atlassian scores the flaw 9.3 (CVSS 4.0, network vector, no privileges, no user interaction), lists Confluence Data Center 1.x to 9.x as affected and 9.2.28 as the fixed version ([Atlassian, 2026-11-09](https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-and-server-1874560038.html)). If patching must wait, clearing the Remote API checkbox needs no restart, and a request to the soap-axis1 confluenceservice-v2 servlet path should then answer HTTP 403. Atlassian says it "cannot confirm if your instances have been affected" and asks teams to check affected instances for compromise ([Atlassian, 2026-11-09](https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-and-server-1874560038.html)); no source reports exploitation, and BSI CERT-Bund's bulletin rates the issue high ([BSI CERT-Bund, 2026-11-10](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4427)). **Exposure:** a Data Center instance on any 9.x or earlier release, with 9.2.28 the only fixed version listed, whose Remote API (XML-RPC & SOAP) setting is ticked, which instances upgraded from old versions or kept for old scripts and add-ons are the likeliest to have; the setting sits under General Configuration, Further Configuration. **Detection:** web access logs for requests to the soap-axis1 servlet path and the XML-RPC endpoint from unexpected sources, and child processes of the Confluence JVM that the application does not normally start. **Defender takeaway:** switch the Remote API off today and upgrade to 9.2.28; because Atlassian asks for a compromise check, review the access logs of any instance that had the API enabled and was reachable from untrusted networks.