CompaniesConfluenceMonthly reportsMarch 2026
Confluence in March 2026: incidents, uptime and changes
2incidents posted
2labelled major or critical
98.19%free of major/critical
98.19%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 13 h 27 min, incident time 13 h 27 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Major 2
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Automation events delayed for some customers in the APAC region | Major | 43 min | resolved | 03-10 | |
| Static macro rendering is failing in Confluence Cloud | Major | 13 h | resolved | 03-12 |
CVEs published
- CVE-2026-27601 Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack (CVSS 5.9)
- CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion (CVSS 7.5)
- CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable (CVSS 8.8)
- CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath (CVSS 8.6)
- CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath (CVSS 5.5)
- CVE-2026-33671 Picomatch has a ReDoS vulnerability via extglob quantifiers (CVSS 7.5)
- CVE-2026-33750 brace-expansion: Zero-step sequence causes process hang and memory exhaustion (CVSS 6.5)
- CVE-2026-33870 Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVSS 7.5)
- CVE-2026-33871 Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass (CVSS 7.5)
- CVE-2026-34043 Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects (CVSS 5.9)
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names (CVSS 8.1)
Cite this
Confluence posted 2 status incidents in March 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Confluence in March 2026
- Vendor
- Confluence
- Date
- URL
- https://rewindex.com/company/confluence/2026/03