Confluence exposure: 1.8 million fingerprint matches depend on which fingerprint you use

A single Confluence instance can contain critical information that attackers seek, such as network diagrams, credential rotation procedures, cloud account structures, escalation paths, and onboarding guides. This information is often accessible within the corporate network and sometimes from the internet for partner access. The amount of exposed data depends on the querying method used, with a significant difference in results.

Three different queries were conducted on ZoomEye on September 26, 2026 (UTC), using Python SDK, with the sub_type=all and page size set to one. The queries were app=Atlassian Confluence, app=Confluence, and title=Confluence. The first two queries returned 1,847,430 and 179,807 matches respectively, while the third query yielded 1,208,692 matches.

The longer application string results in approximately ten times more matches than the shorter one. The fully qualified name (app=Atlassian Confluence) provides a more accurate fingerprint, while the short form (app=Confluence) is less predictable. The title query is a broader set that includes login pages, 404 pages, and any page mentioning the product, making it noisier but also capturing unrecognized signatures.

For operators, it is crucial to understand that the finding depends on the chosen fingerprint. Recording both fingerprints with the collection time ensures reproducibility in future evaluations. To ensure proper security measures, organizations should ask questions about anonymous access, public link audits and expiration, instance version updates, and separating administrative accounts from content authors.

Continuous monitoring is recommended, as a reachable Confluence instance often indicates a new deployment or migration with potentially permissive initial configurations.