This vulnerability affects certain versions of Atlassian Confluence Data Center. 

Confluence utilizes a third-party library Apache Axis as part of its XML-RPC and SOAP APIs. Apache Axis has published a critical vulnerability (CVE-2026-90436) that allows remote code execution. 

To be vulnerable, the Confluence instance must have the ‘Remote API (XML-RPC & SOAP)’ enabled. Please note that this setting was turned off by default for new installations starting in Confluence 3.0. This feature was fully removed in Confluence 10.0.

Impact
If Remote API (XML-RPC & SOAP) is enabled, an unauthenticated attacker who can reach the Confluence instance can execute arbitrary commands with the privileges of the Confluence operating-system account. This could allow the attacker to read or alter application data and secrets accessible to that account, modify files, and disrupt the Confluence service.