Atlassian issues Friday patch for critical Confluence auth bypass, urges immediate on‑prem updates
Marcus Webb ·
Atlassian on Friday released a critical security update for Confluence Data Center and Server that fixes an authentication bypass tracked as CVE-2026-37624. The flaw carries a CVSS base score of 9.8 and can allow unauthenticated attackers to access administrative REST endpoints on affected on‑prem deployments. Atlassian Cloud is not impacted.
The timing matters because Confluence on‑prem instances are frequent ransomware and espionage targets, and prior Confluence flaws saw exploitation within days. Security teams that expose Confluence to the internet should patch or remove external access before going offline for the weekend.
Atlassian said the vulnerability affects supported Confluence Data Center and Server versions in the 8.x and 9.x branches under specific configurations that enable access to certain administrative REST paths without a valid session token. The company said it has not observed in‑the‑wild exploitation at the time of publication.
Fixed releases are available now, including 8.5.18 for the current LTS track, 9.0.3, and 9.1.1. Atlassian advised customers to upgrade to a patched version rather than apply point mitigations whenever feasible.
For environments that cannot upgrade immediately, Atlassian provided temporary mitigations. These include restricting network access to Confluence to trusted VPNs, denying external requests to /rest/plugins and /admin endpoints at the reverse proxy, and disabling affected modules listed in the advisory. The company cautioned that mitigations reduce exposure but do not eliminate risk.
Internet scans continue to show many Confluence servers exposed to the public web. The US Cybersecurity and Infrastructure Security Agency has historically added exploited Confluence CVEs to its Known Exploited Vulnerabilities catalog, which triggers short patching deadlines for federal agencies. Private sector defenders should expect similar urgency if exploitation emerges.
Atlassian recommended administrators review access logs for unexpected requests to administrative paths, newly created users, or unexpected plugin installations. The vendor also urged customers to verify backups and incident response playbooks in case compromise is suspected.
Friday afternoon disclosure windows remain a stress test for self‑hosted collaboration software. Enterprises that keep Confluence on‑prem for data control or customization will need to budget for rapid out‑of‑band updates and stricter perimeter controls, or move internet exposure behind zero trust access to reduce weekend risk.