CVE-2025-22166High· 7.5▾ Twilight

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unava…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 21, 2025

Updated

Oct 8, 2026

CVSS

7.5

Vendor

atlassian

Product

confluence_data_center

CWE

CWE-405

Depth score

41 · Moderate

EPSS

0.50% · p43

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 30.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 352 days

Oct 21, 2025Published
Disclosed via NVD
Sep 30, 2026EPSS first tracked
0.5%
Oct 8, 2026Record revised
Last analysed / modified upstream

atlassian CWE-405 #nvd

Affected

confluence_data_center >= 8.5.0, < 8.5.25
confluence_data_center >= 9.2.0, < 9.2.7
confluence_data_center >= 10.0.0, < 10.0.2
confluence_server >= 8.5.0, < 8.5.25
confluence_server >= 9.2.0, < 9.2.7
confluence_server >= 10.0.0, < 10.0.2

Patched in

confluence_data_center 10.0.2
confluence_server 10.0.2

Full technical detail▾

Overview

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Atlassian (Internal) program.

Affected

confluence_data_center >= 8.5.0, < 8.5.25
confluence_data_center >= 9.2.0, < 9.2.7
confluence_data_center >= 10.0.0, < 10.0.2
confluence_server >= 8.5.0, < 8.5.25
confluence_server >= 9.2.0, < 9.2.7
confluence_server >= 10.0.0, < 10.0.2

Remediation

Upgrade past the affected range:

confluence_data_center 10.0.2
confluence_server 10.0.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed

CVE-2025-22166High· 7.5▾ Twilight

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unava…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 21, 2025

Updated

Oct 8, 2026

CVSS

7.5

Vendor

atlassian

Product

confluence_data_center

CWE

CWE-405

Depth score

41 · Moderate

EPSS

0.50% · p43

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 30.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 352 days

Oct 21, 2025Published
Disclosed via NVD
Sep 30, 2026EPSS first tracked
0.5%
Oct 8, 2026Record revised
Last analysed / modified upstream

atlassian CWE-405 #nvd

Affected

confluence_data_center >= 8.5.0, < 8.5.25
confluence_data_center >= 9.2.0, < 9.2.7
confluence_data_center >= 10.0.0, < 10.0.2
confluence_server >= 8.5.0, < 8.5.25
confluence_server >= 9.2.0, < 9.2.7
confluence_server >= 10.0.0, < 10.0.2

Patched in

confluence_data_center 10.0.2
confluence_server 10.0.2

Full technical detail▾

Overview

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.

This vulnerability was reported via our Atlassian (Internal) program.

Affected

confluence_data_center >= 8.5.0, < 8.5.25
confluence_data_center >= 9.2.0, < 9.2.7
confluence_data_center >= 10.0.0, < 10.0.2
confluence_server >= 8.5.0, < 8.5.25
confluence_server >= 9.2.0, < 9.2.7
confluence_server >= 10.0.0, < 10.0.2

Remediation

Upgrade past the affected range:

confluence_data_center 10.0.2
confluence_server 10.0.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd