Security Resilience

CVE-2022-26134

RCE in Atlassian Confluence Data Center 1.3 – 7.4.17

CISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linkedRCE
Published
03 June 2022
Modified
24 October 2025
KEV Added
02 June 2022
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.99 100.0th percentile
Risk Priority 97 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2022-26134 is a critical-severity Expression Language Injection (CWE-917) vulnerability in Atlassian Confluence Data Center. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2022-26134 is an OGNL injection vulnerability in Atlassian Confluence Server and Data Center that permits unauthenticated remote code execution. The flaw affects versions 1.3.0 through 7.4.16, 7.13.0 through 7.13.6, 7.14.0 through 7.14.2, 7.15.0 through 7.15.1, 7.16.0 through 7.16.3, 7.17.0 through 7.17.3, and 7.18.0, all prior to the respective fixed releases 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1. It carries a CVSS 3.1 base score of 9.8 and is tracked under CWE-917.

An unauthenticated attacker with network access can supply a crafted OGNL expression in an HTTP request to the Confluence instance, resulting in arbitrary code execution with the privileges of the Confluence process. Successful exploitation grants full control over the server, including the ability to read or modify any data, install persistent backdoors, or pivot within the environment.

Public proof-of-concept exploits have been posted to Packet Storm, and the current EPSS score of 0.9441 (with a recorded peak of 0.9755) indicates sustained exploitation interest following disclosure. The vendor advisory at confluence.atlassian.com recommends immediate upgrade to one of the fixed versions listed above.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17,…

more

from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

CWE(s)
CWE-917
KEV Date Added
02 June 2022

Related Threats

Threat-Actor AttributionAI

Cl0p (G0092)aka TA505
Cl0p (TA505/FIN11) ransomware operators mass-exploited CVE-2022-26134 against Confluence as documented in CISA KEV and vendor reports from Mandiant, Microsoft, and Unit 42.
Microsoft Corp. (Salesforce / Slack engineer recruitment claims)
Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors | CISA
HAFNIUM (G0125)
Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors | CISA
AnonOps
Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors | CISA
CrowdStrike (McAfee / Symantec civil claims)
Russian Military Cyber Actors Target US and Global Critical Infrastructure | CISA
SentinelOne (Cylance / BlackBerry civil claims)
Russian Military Cyber Actors Target US and Global Critical Infrastructure | CISA
Ember Bear (G1003)
Russian Military Cyber Actors Target US and Global Critical Infrastructure | CISA
Apple Inc. (Masimo pulse-oximetry trade-secret 2020-2024)
2023 Top Routinely Exploited Vulnerabilities | CISA
Clop
2023 Top Routinely Exploited Vulnerabilities | CISA

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1016.002 Wi-Fi Discovery Discovery
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2021-26084Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2021-26085Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2023-22515Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2019-3396Same product: Atlassian Confluence Serverboth on KEV
CVE-2023-22527Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2019-3398Same product: Atlassian Confluence Serverboth on KEV
CVE-2023-22518Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2024-21677Same product: Atlassian Confluence Data Center
CVE-2022-26138Same product: Atlassian Confluence Data Centerboth on KEV
CVE-2024-21690Same product: Atlassian Confluence Data Center

Affected Assets

atlassian
confluence data center
7.18.0 · 1.3 — 7.4.17 · 7.13.0 — 7.13.7 · 7.14.0 — 7.14.3
atlassian
confluence server
7.18.0 · 1.3 — 7.4.17 · 7.13.0 — 7.13.7 · 7.14.0 — 7.14.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.1.2
  • V1.3.2
  • V1.3.5
  • V4.3.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require input neutralization and safe EL construction to prevent injection flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.5.3 Segregation of duties partial match
removes

References