confluence vulnerabilities and fixes

Q: How do I fix confluence vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is confluence being exploited right now?

None of the tracked confluence CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which confluence CVE should I patch first?

CVE-2025-54525 currently ranks highest (38/100): Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to .

Recent CVEs affecting confluence, with upgrade or downgrade steps. 14 tracked.

confluence has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-02-06. Highest priority: CVE-2025-54525 (score 38/100).

CVE-2025-8285 MEDIUM 4.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows
CVE-2025-54525 HIGH 7.5 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
CVE-2025-54478 HIGH 7.2 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost inst
CVE-2025-54463 MEDIUM 5.9 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
CVE-2025-54458 MEDIUM 5.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space whic
CVE-2025-53910 MEDIUM 4.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows
CVE-2025-53857 LOW 3.7 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows
CVE-2025-53514 MEDIUM 5.9 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
CVE-2025-52931 HIGH 7.5 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
CVE-2025-49221 LOW 3.7 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost inst
CVE-2025-48731 MEDIUM 6.4 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space whic
CVE-2025-44004 HIGH 7.2 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost ins
CVE-2025-44001 MEDIUM 4.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows
CVE-2025-13523 HIGH 7.7 UPGRADE Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML tem

FAQ

How do I fix confluence vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is confluence being exploited right now?

None of the tracked confluence CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which confluence CVE should I patch first?

CVE-2025-54525 currently ranks highest (38/100): Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to .

RSS feed for confluence · ← Back to latest CVEs