# Confluence in August 2026: incidents, uptime and changes

> Confluence in August 2026: 5 incidents on its status page (2 major or critical), 99.09% free of major or critical incidents (vendor-reported), 36 CVEs. From Rewindex’s archive of Confluence’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/confluence/2026/08
Last updated: 2026-10-26T10:10:00Z

- Incidents posted: 5 (major/critical: 2) · Maintenance: 0
- By vendor impact label: critical 1, major 1, minor 3
- Uptime (vendor-reported): 99.09% free of major/critical incidents, 97.90% free of any incident; outage time 6 h 45 min, incident time 15 h 34 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 36
- Previous month: [July 2026](https://rewindex.com/company/confluence/2026/07.md) · Next: [September 2026](https://rewindex.com/company/confluence/2026/09.md) · [All months](https://rewindex.com/company/confluence/reports.md) · [Confluence](https://rewindex.com/company/confluence.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## Major and critical incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Issues accessing multiple Atlassian products in some regions](https://rewindex.com/company/confluence/incidents/qq07180qzmpp.md) | critical | 2026-08-27 04:22 UTC | 2026-08-27 05:16 UTC | 54 min | postmortem |
| [Notifications are delayed](https://rewindex.com/company/confluence/incidents/n719bx37vb9h.md) | major | 2026-08-25 08:42 UTC | 2026-08-25 14:33 UTC | 5.8 h | resolved |

## All incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Confluence intermittent errors](https://rewindex.com/company/confluence/incidents/0x62gw860393.md) | minor | 2026-08-12 20:11 UTC | 2026-08-12 22:13 UTC | 2.0 h | resolved |
| [Marketplace App Macros Not Rendering in Confluence](https://rewindex.com/company/confluence/incidents/k6nf4t8dgd1x.md) | minor | 2026-08-21 07:16 UTC | 2026-08-21 10:10 UTC | 2.9 h | resolved |
| [Degraded performance of Notifications](https://rewindex.com/company/confluence/incidents/zr18p2cv7c14.md) | minor | 2026-08-24 19:22 UTC | 2026-08-24 23:15 UTC | 3.9 h | resolved |
| [Notifications are delayed](https://rewindex.com/company/confluence/incidents/n719bx37vb9h.md) | major | 2026-08-25 08:42 UTC | 2026-08-25 14:33 UTC | 5.8 h | resolved |
| [Issues accessing multiple Atlassian products in some regions](https://rewindex.com/company/confluence/incidents/qq07180qzmpp.md) | critical | 2026-08-27 04:22 UTC | 2026-08-27 05:16 UTC | 54 min | postmortem |

## CVEs published

- [CVE-2026-8763](https://rewindex.com/cve/CVE-2026-8763.md) Name Constraints bypass via trailing dot in rfc822Name and URI (CVSS 9.1), published 2026-08-03
- [CVE-2026-12185](https://rewindex.com/cve/CVE-2026-12185.md) BKS/UBER keystore allocates from untrusted lengths before integrity check (CVSS 8.6), published 2026-08-03
- [CVE-2026-59651](https://rewindex.com/cve/CVE-2026-59651.md) BKS keystore accepts legacy version with 16-bit integrity MAC key (CVSS 7.5), published 2026-08-03
- [CVE-2026-59650](https://rewindex.com/cve/CVE-2026-59650.md) MTI/A0 DH agreement exponentiates unvalidated peer value (CVSS 9.1), published 2026-08-03
- [CVE-2026-59645](https://rewindex.com/cve/CVE-2026-59645.md) OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (CVSS 7.5), published 2026-08-03
- [CVE-2026-59642](https://rewindex.com/cve/CVE-2026-59642.md) CMS AuthenticatedData content not bound to MAC when authAttrs present (CVSS 7.5), published 2026-08-03
- [CVE-2026-59641](https://rewindex.com/cve/CVE-2026-59641.md) S/MIME validator trusts signer-asserted signingTime for path validation (CVSS 5.3), published 2026-08-03
- [CVE-2026-59639](https://rewindex.com/cve/CVE-2026-59639.md) CMS verifySignatures returns true for SignedData with zero signers (CVSS 7.5), published 2026-08-03
- [CVE-2026-58062](https://rewindex.com/cve/CVE-2026-58062.md) Stapled OCSP response accepted without binding to the checked certificate (CVSS 9.1), published 2026-08-03
- [CVE-2026-58061](https://rewindex.com/cve/CVE-2026-58061.md) CCM-family modes write plaintext to caller buffer before tag check (CVSS 7.5), published 2026-08-03
- [CVE-2026-58060](https://rewindex.com/cve/CVE-2026-58060.md) HSS public-key level count unbounded, enabling huge allocation on verify (CVSS 7.5), published 2026-08-03
- [CVE-2026-58059](https://rewindex.com/cve/CVE-2026-58059.md) Quadratic-time escaping when stringifying X.500 distinguished names (CVSS 7.5), published 2026-08-03
- [CVE-2026-14682](https://rewindex.com/cve/CVE-2026-14682.md) Possible OOM from unbounded up-front allocation on a definite-length read (CVSS 7.5), published 2026-08-03
- [CVE-2026-12802](https://rewindex.com/cve/CVE-2026-12802.md) CMS AuthEnvelopedData fails to enforce tag-length on decryption (CVSS 7.5), published 2026-08-03
- [CVE-2026-12803](https://rewindex.com/cve/CVE-2026-12803.md) KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) (CVSS 7.5), published 2026-08-03
- [CVE-2026-12816](https://rewindex.com/cve/CVE-2026-12816.md) IESEngine stream-mode MAC forgery via length-dependent KDF split (CVSS 7.5), published 2026-08-03
- [CVE-2026-12860](https://rewindex.com/cve/CVE-2026-12860.md) RSA PKCS\#1 verification skips last two hash bytes in NULL-omitted path (CVSS 5.3), published 2026-08-03
- [CVE-2026-13506](https://rewindex.com/cve/CVE-2026-13506.md) Lazy ASN.1 sequence forcing resets nesting-depth guard (CVSS 7.5), published 2026-08-03
- [CVE-2026-73086](https://rewindex.com/cve/CVE-2026-73086.md) nanoid: Integer Overflow or Wraparound (CVSS 7.4), published 2026-08-11
- [CVE-2026-73507](https://rewindex.com/cve/CVE-2026-73507.md) Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion (CVSS 7.5), published 2026-08-13
- [CVE-2026-73508](https://rewindex.com/cve/CVE-2026-73508.md) Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names (CVSS 5.3), published 2026-08-13
- [CVE-2026-73566](https://rewindex.com/cve/CVE-2026-73566.md) node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection (CVSS 7.5), published 2026-08-13
- [CVE-2026-19693](https://rewindex.com/cve/CVE-2026-19693.md) extract-zip arbitrary file write outside the destination directory via a symlink at the final path component (CVSS 8.1), published 2026-08-17
- [CVE-2026-73646](https://rewindex.com/cve/CVE-2026-73646.md) PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure (CVSS 7.5), published 2026-08-17
- [CVE-2026-21580](https://rewindex.com/cve/CVE-2026-21580.md)  (CVSS 8.6), published 2026-08-18
- [CVE-2026-75595](https://rewindex.com/cve/CVE-2026-75595.md) Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVSS 9.1), published 2026-08-19
- [CVE-2026-62243](https://rewindex.com/cve/CVE-2026-62243.md) Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass (CVSS 7.5), published 2026-08-22
- [CVE-2026-65182](https://rewindex.com/cve/CVE-2026-65182.md) Apache Tomcat: Bypass longest prefix security constraint (CVSS 9.1), published 2026-08-25
- [CVE-2026-65183](https://rewindex.com/cve/CVE-2026-65183.md) Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (CVSS 8.1), published 2026-08-25
- [CVE-2026-65637](https://rewindex.com/cve/CVE-2026-65637.md) Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete (CVSS 9.8), published 2026-08-25
- [CVE-2026-65905](https://rewindex.com/cve/CVE-2026-65905.md) Apache Tomcat: Limited replay attack possible with DIGEST authentication (CVSS 9.8), published 2026-08-25
- [CVE-2026-65927](https://rewindex.com/cve/CVE-2026-65927.md) Apache Tomcat: RewriteValve \[N\] restarts at the second rule and may bypass access control (CVSS 7.5), published 2026-08-25
- [CVE-2026-66422](https://rewindex.com/cve/CVE-2026-66422.md) Apache Tomcat: Servlet role references can bypass declarative role constraints (CVSS 8.1), published 2026-08-25
- [CVE-2026-68525](https://rewindex.com/cve/CVE-2026-68525.md) Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (CVSS 9.1), published 2026-08-25
- [CVE-2026-68569](https://rewindex.com/cve/CVE-2026-68569.md) Apache Tomcat: Principal lookup can fail open in some cases (CVSS 8.1), published 2026-08-25
- [CVE-2026-68763](https://rewindex.com/cve/CVE-2026-68763.md) Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (CVSS 7.5), published 2026-08-25

## Cite this

Confluence posted 5 status incidents in August 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/confluence/2026/08
- Citation: Confluence, “Confluence in August 2026” (2026-08-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/confluence/2026/08 (CC BY 4.0).
- Markdown link: `[Confluence: Confluence in August 2026 (2026-08-01)](https://rewindex.com/company/confluence/2026/08)`


---
Canonical: https://rewindex.com/company/confluence/2026/08 · Markdown: https://rewindex.com/company/confluence/2026/08.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T15:24:54.952Z