CompaniesConfluenceMonthly reportsJune 2026
Confluence in June 2026: incidents, uptime and changes
3incidents posted
0labelled major or critical
100%free of major/critical
99.31%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 0 min, incident time 4 h 57 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Minor 3
Incidents 3
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Delays in processing incoming Emails, Work Item notifications, and Scheduled Triggers in Marketplace Apps | Minor | 17 min | resolved | 06-10 | |
| Degraded performance with Confluence Cloud | Minor | 2.5 h | postmortem | 06-12 | |
| Confluence Cloud experiencing degraded viewing experience | Minor | 2.2 h | postmortem | 06-16 |
CVEs published
- CVE-2026-40983 Micrometer gRPC server instrumentation DoS vulnerability (CVSS 7.5)
- CVE-2026-41842 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux (CVSS 7.5)
- CVE-2026-41845 Spring Framework Cross-site Scripting via JavaScriptUtils (CVSS 7.1)
- CVE-2026-41850 Spring Framework Algorithmic Denial of Service via SpEL Expressions (CVSS 7.5)
- CVE-2026-46625 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection (CVSS 7.5)
- CVE-2026-44492 Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) (CVSS 8.6)
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` (CVSS 8.7)
- CVE-2026-44495 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.0)
- CVE-2026-44496 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection (CVSS 7.5)
- CVE-2026-44490 Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions (CVSS 4.8)
- CVE-2026-44488 Axios: Allocation of Resources Without Limits or Throttling in axios (CVSS 7.5)
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter (CVSS 7.5)
- CVE-2026-44486 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection (CVSS 7.5)
- CVE-2026-44249 Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (CVSS 8.1)
- CVE-2026-45416 Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (CVSS 7.5)
- CVE-2026-45674 Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (CVSS 8.7)
- CVE-2026-47691 Netty has Insufficient Bailiwick Validation for NS Records (CVSS 8.7)
- CVE-2026-48043 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion (CVSS 5.3)
- CVE-2026-50010 Netty's wrapping plain trust manager silently disables hostname verification (CVSS 7.5)
- CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) (CVSS 7.5)
- CVE-2026-48779 ws: Memory exhaustion DoS from tiny fragments and data chunks (CVSS 7.5)
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVSS 8.1)
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation (CVSS 8.1)
- CVE-2026-13006 Incomplete protection against CVE-2025-11226 (CVSS 7.0)
- CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization (CVSS 7.5)
- CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve (CVSS 7.3)
- CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector (CVSS 9.1)
- CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete (CVSS 9.1)
Cite this
Confluence posted 3 status incidents in June 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Confluence in June 2026
- Vendor
- Confluence
- Date
- URL
- https://rewindex.com/company/confluence/2026/06