CompaniesConfluenceMonthly reportsAugust 2026
Confluence in August 2026: incidents, uptime and changes
5incidents posted
2labelled major or critical
99.09%free of major/critical
97.90%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 6 h 45 min, incident time 15 h 34 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Critical 1 · Major 1 · Minor 3
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Issues accessing multiple Atlassian products in some regions | Critical | 54 min | postmortem | 08-27 | |
| Notifications are delayed | Major | 5.8 h | resolved | 08-25 |
Other incidents 3
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Confluence intermittent errors | Minor | 2.0 h | resolved | 08-12 | |
| Marketplace App Macros Not Rendering in Confluence | Minor | 2.9 h | resolved | 08-21 | |
| Degraded performance of Notifications | Minor | 3.9 h | resolved | 08-24 |
CVEs published
- CVE-2026-8763 Name Constraints bypass via trailing dot in rfc822Name and URI (CVSS 9.1)
- CVE-2026-12185 BKS/UBER keystore allocates from untrusted lengths before integrity check (CVSS 8.6)
- CVE-2026-59651 BKS keystore accepts legacy version with 16-bit integrity MAC key (CVSS 7.5)
- CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value (CVSS 9.1)
- CVE-2026-59645 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (CVSS 7.5)
- CVE-2026-59642 CMS AuthenticatedData content not bound to MAC when authAttrs present (CVSS 7.5)
- CVE-2026-59641 S/MIME validator trusts signer-asserted signingTime for path validation (CVSS 5.3)
- CVE-2026-59639 CMS verifySignatures returns true for SignedData with zero signers (CVSS 7.5)
- CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate (CVSS 9.1)
- CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check (CVSS 7.5)
- CVE-2026-58060 HSS public-key level count unbounded, enabling huge allocation on verify (CVSS 7.5)
- CVE-2026-58059 Quadratic-time escaping when stringifying X.500 distinguished names (CVSS 7.5)
- CVE-2026-14682 Possible OOM from unbounded up-front allocation on a definite-length read (CVSS 7.5)
- CVE-2026-12802 CMS AuthEnvelopedData fails to enforce tag-length on decryption (CVSS 7.5)
- CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) (CVSS 7.5)
- CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split (CVSS 7.5)
- CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (CVSS 5.3)
- CVE-2026-13506 Lazy ASN.1 sequence forcing resets nesting-depth guard (CVSS 7.5)
- CVE-2026-73086 nanoid: Integer Overflow or Wraparound (CVSS 7.4)
- CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion (CVSS 7.5)
- CVE-2026-73508 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names (CVSS 5.3)
- CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection (CVSS 7.5)
- CVE-2026-19693 extract-zip arbitrary file write outside the destination directory via a symlink at the final path component (CVSS 8.1)
- CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure (CVSS 7.5)
- CVE-2026-21580 (CVSS 8.6)
- CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVSS 9.1)
- CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass (CVSS 7.5)
- CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint (CVSS 9.1)
- CVE-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (CVSS 8.1)
- CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete (CVSS 9.8)
- CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication (CVSS 9.8)
- CVE-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control (CVSS 7.5)
- CVE-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints (CVSS 8.1)
- CVE-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (CVSS 9.1)
- CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases (CVSS 8.1)
- CVE-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (CVSS 7.5)
Cite this
Confluence posted 5 status incidents in August 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Confluence in August 2026
- Vendor
- Confluence
- Date
- URL
- https://rewindex.com/company/confluence/2026/08