CompaniesConfluenceMonthly reportsApril 2026
Confluence in April 2026: incidents, uptime and changes
3incidents posted
2labelled major or critical
98.63%free of major/critical
98.25%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 9 h 48 min, incident time 12 h 36 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Critical 2 · Minor 1
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Multiple products impacted by search failures | Critical | 6.0 h | postmortem | 04-08 | |
| Disrupted Rovo availability for Automation rules | Critical | 3.8 h | resolved | 04-14 |
Other incidents 1
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Users experiencing issues with login across Atlassian products | Minor | 2.8 h | postmortem | 04-13 |
CVEs published
- CVE-2025-62718 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF (CVSS 7.0)
- CVE-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension (CVSS 7.5)
- CVE-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVSS 9.1)
- CVE-2026-29146 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVSS 7.5)
- CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs (CVSS 7.5)
- CVE-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVSS 7.5)
- CVE-2026-40175 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (CVSS 4.8)
- CVE-2026-2332 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVSS 7.4)
- CVE-2025-14813 GOSTCTR implementation unable to process more than 255 blocks correctly (CVSS 7.5)
- CVE-2026-42033 Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking (CVSS 7.4)
- CVE-2026-42035 Axios: Header Injection via Prototype Pollution (CVSS 7.4)
- CVE-2026-42043 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 (CVSS 7.2)
- CVE-2026-42041 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy (CVSS 4.8)
- CVE-2026-42198 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS (CVSS 7.5)
Cite this
Confluence posted 3 status incidents in April 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Confluence in April 2026
- Vendor
- Confluence
- Date
- URL
- https://rewindex.com/company/confluence/2026/04