CompaniesConfluenceMonthly reportsMay 2026
Confluence in May 2026: incidents, uptime and changes
4incidents posted
2labelled major or critical
99.50%free of major/critical
96.61%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 3 h 39 min, incident time 25 h 9 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Critical 1 · Major 1 · Minor 2
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Users experiencing issues accessing multiple Atlassian products | Critical | 1.9 h | postmortem | 05-14 | |
| Users facing errors when attempting to view Calendars in Confluence | Major | 1.8 h | resolved | 05-27 |
Other incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Multiple Atlassian services are experiencing issues | Minor | 18 h | postmortem | 05-08 | |
| Some macros failing to load in the Confluence Cloud editor | Minor | 3.3 h | resolved | 05-26 |
CVEs published
- CVE-2026-6321 fast-uri vulnerable to path traversal via percent-encoded dot segments (CVSS 7.5)
- CVE-2026-6322 fast-uri vulnerable to host confusion via percent-encoded authority delimiters (CVSS 7.5)
- CVE-2026-42264 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking (CVSS 7.4)
- CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling (CVSS 7.5)
- CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure (CVSS 7.3)
- CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated (CVSS 9.8)
- CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user (CVSS 9.8)
- CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive (CVSS 7.5)
- CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied (CVSS 9.1)
- CVE-2026-42579 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) (CVSS 7.5)
- CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion (CVSS 7.5)
- CVE-2026-42584 Netty: HttpClientCodec response desynchronization (CVSS 7.3)
- CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding (CVSS 6.5)
- CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS (CVSS 7.5)
- CVE-2026-45736 ws: Uninitialized memory disclosure (CVSS 4.4)
- CVE-2026-45149 brace-expansion: Large numeric range defeats documented `max` DoS protection (CVSS 6.5)
Cite this
Confluence posted 4 status incidents in May 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Confluence in May 2026
- Vendor
- Confluence
- Date
- URL
- https://rewindex.com/company/confluence/2026/05