Confluence Data Center's remote API makes an Axis flaw urgent
Atlassian published CVE-2026-90436 on November 9, 2026. The advisory describes remote code execution in Apache Axis, a third-party component used by Confluence Data Center's XML-RPC and SOAP APIs. The relevant Confluence setting is "Remote API (XML-RPC & SOAP)." A deployment must have that interface enabled to meet the advisory's stated exposure condition.
The condition narrows the population, but it does not make the issue easy to dismiss. Older Confluence installations often retain remote API access for scripts, automation, and third-party add-ons. Those integrations can outlive the team that introduced them. An interface that once supported a migration project may remain enabled after the project closes, with no owner and no review.
Atlassian rates the issue critical with a CVSS 4.0 score of 9.3. The affected versions include Confluence Data Center 1.x through 9.x. Confluence 10.x and later are not affected because the remote API feature was removed. Atlassian Cloud sites are also outside the vulnerable scope. The vendor lists Confluence Data Center 9.2.28 as a fixed version and recommends upgrading to the latest release or a fixed long-term support build.
Check exposure before choosing a maintenance window
The first check is whether the remote API is enabled. Administrators can inspect the setting in General Configuration and Further Configuration. At the time of the advisory, the setting took effect without requiring a restart. Disabling it may break scripts, automation, and add-ons, so the team should identify dependencies before changing production.
Atlassian provides a direct validation step. After disabling the remote API, browse to the Confluence base URL followed by /plugins/servlet/soap-axis1/confluenceservice-v2. A correctly applied mitigation returns HTTP 403. A page that still describes the service or returns an Axis response needs another review.
Upgrading to 9.2.28, a later supported fixed line, or Confluence 10.x removes the vulnerable path. Teams that cannot patch immediately should treat the configuration change as an emergency containment measure and schedule the upgrade. A temporary setting should not become the permanent control.
Hunt for signs of misuse
Atlassian states that it cannot confirm whether an instance has been compromised. Local teams therefore need to look for evidence around the exposed interface. Start with web server and reverse proxy logs for requests to the SOAP and XML-RPC paths. Compare the source addresses with expected automation hosts and integration accounts.
Review recent changes to administrative accounts, application links, add-ons, and configuration exports. A remote API compromise could provide a stronger position from which to change content or reach integrations, although the advisory does not describe a specific post-exploitation chain. Treat unexplained activity as a reason for investigation rather than proof of exploitation.
The completion check should cover four facts: every affected node is on a fixed build, the remote API is disabled where it is not needed, the validation endpoint returns 403, and the integration owners have confirmed that remaining access is expected. A Confluence cluster also needs the check repeated on every node, not just the node used for the administrative test.
Top comments (0)