# Confluence in April 2026: incidents, uptime and changes

> Confluence in April 2026: 3 incidents on its status page (2 major or critical), 98.63% free of major or critical incidents (vendor-reported), 14 CVEs. From Rewindex’s archive of Confluence’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/confluence/2026/04
Last updated: 2026-10-26T22:10:00Z

- Incidents posted: 3 (major/critical: 2) · Maintenance: 0
- By vendor impact label: critical 2, minor 1
- Uptime (vendor-reported): 98.63% free of major/critical incidents, 98.25% free of any incident; outage time 9 h 48 min, incident time 12 h 36 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 14
- Previous month: [March 2026](https://rewindex.com/company/confluence/2026/03.md) · Next: [May 2026](https://rewindex.com/company/confluence/2026/05.md) · [All months](https://rewindex.com/company/confluence/reports.md) · [Confluence](https://rewindex.com/company/confluence.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## Major and critical incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Multiple products impacted by search failures](https://rewindex.com/company/confluence/incidents/7g63c08d951j.md) | critical | 2026-04-08 05:41 UTC | 2026-04-08 11:43 UTC | 6.0 h | postmortem |
| [Disrupted Rovo availability for Automation rules](https://rewindex.com/company/confluence/incidents/4fwvl5sdyz7m.md) | critical | 2026-04-14 12:25 UTC | 2026-04-14 16:11 UTC | 3.8 h | resolved |

## All incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Multiple products impacted by search failures](https://rewindex.com/company/confluence/incidents/7g63c08d951j.md) | critical | 2026-04-08 05:41 UTC | 2026-04-08 11:43 UTC | 6.0 h | postmortem |
| [Users experiencing issues with login across Atlassian products](https://rewindex.com/company/confluence/incidents/h5wxgc6k1rm6.md) | minor | 2026-04-13 07:29 UTC | 2026-04-13 10:17 UTC | 2.8 h | postmortem |
| [Disrupted Rovo availability for Automation rules](https://rewindex.com/company/confluence/incidents/4fwvl5sdyz7m.md) | critical | 2026-04-14 12:25 UTC | 2026-04-14 16:11 UTC | 3.8 h | resolved |

## CVEs published

- [CVE-2025-62718](https://rewindex.com/cve/CVE-2025-62718.md) Axios has a NO\_PROXY Hostname Normalization Bypass that Leads to SSRF (CVSS 7.0), published 2026-04-09
- [CVE-2026-24880](https://rewindex.com/cve/CVE-2026-24880.md) Apache Tomcat: Request smuggling via invalid chunk extension (CVSS 7.5), published 2026-04-09
- [CVE-2026-29145](https://rewindex.com/cve/CVE-2026-29145.md) Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVSS 9.1), published 2026-04-09
- [CVE-2026-29146](https://rewindex.com/cve/CVE-2026-29146.md) Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVSS 7.5), published 2026-04-09
- [CVE-2026-34483](https://rewindex.com/cve/CVE-2026-34483.md) Apache Tomcat: Incomplete escaping of JSON access logs (CVSS 7.5), published 2026-04-09
- [CVE-2026-34487](https://rewindex.com/cve/CVE-2026-34487.md) Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVSS 7.5), published 2026-04-09
- [CVE-2026-40175](https://rewindex.com/cve/CVE-2026-40175.md) Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (CVSS 4.8), published 2026-04-10
- [CVE-2026-2332](https://rewindex.com/cve/CVE-2026-2332.md) HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVSS 7.4), published 2026-04-14
- [CVE-2025-14813](https://rewindex.com/cve/CVE-2025-14813.md) GOSTCTR implementation unable to process more than 255 blocks correctly (CVSS 7.5), published 2026-04-15
- [CVE-2026-42033](https://rewindex.com/cve/CVE-2026-42033.md) Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking (CVSS 7.4), published 2026-04-24
- [CVE-2026-42035](https://rewindex.com/cve/CVE-2026-42035.md) Axios: Header Injection via Prototype Pollution (CVSS 7.4), published 2026-04-24
- [CVE-2026-42043](https://rewindex.com/cve/CVE-2026-42043.md) Axios: Incomplete Fix for CVE-2025-62718 — NO\_PROXY  Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8)  in Axios 1.15.0 (CVSS 7.2), published 2026-04-24
- [CVE-2026-42041](https://rewindex.com/cve/CVE-2026-42041.md) Axios: Authentication Bypass via Prototype Pollution Gadget in \`validateStatus\` Merge Strategy (CVSS 4.8), published 2026-04-24
- [CVE-2026-42198](https://rewindex.com/cve/CVE-2026-42198.md) pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS (CVSS 7.5), published 2026-04-29

## Cite this

Confluence posted 3 status incidents in April 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/confluence/2026/04
- Citation: Confluence, “Confluence in April 2026” (2026-04-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/confluence/2026/04 (CC BY 4.0).
- Markdown link: `[Confluence: Confluence in April 2026 (2026-04-01)](https://rewindex.com/company/confluence/2026/04)`


---
Canonical: https://rewindex.com/company/confluence/2026/04 · Markdown: https://rewindex.com/company/confluence/2026/04.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T12:52:31.151Z