Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2022-26134 is a critical-severity Expression Language Injection (CWE-917) vulnerability in Atlassian Confluence Data Center. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-26134 is an OGNL injection vulnerability in Atlassian Confluence Server and Data Center that permits unauthenticated remote code execution. The flaw affects versions 1.3.0 through 7.4.16, 7.13.0 through 7.13.6, 7.14.0 through 7.14.2, 7.15.0 through 7.15.1, 7.16.0 through 7.16.3, 7.17.0 through 7.17.3, and 7.18.0, all prior to the respective fixed releases 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1. It carries a CVSS 3.1 base score of 9.8 and is tracked under CWE-917.
An unauthenticated attacker with network access can supply a crafted OGNL expression in an HTTP request to the Confluence instance, resulting in arbitrary code execution with the privileges of the Confluence process. Successful exploitation grants full control over the server, including the ability to read or modify any data, install persistent backdoors, or pivot within the environment.
Public proof-of-concept exploits have been posted to Packet Storm, and the current EPSS score of 0.9441 (with a recorded peak of 0.9755) indicates sustained exploitation interest following disclosure. The vendor advisory at confluence.atlassian.com recommends immediate upgrade to one of the fixed versions listed above.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30701
Vulnerability Data
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17,…
more
from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
- CWE(s)
- KEV Date Added
- 02 June 2022
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.3.2V1.3.5V4.3.1
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and safe EL construction to prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect EL injection but does not itself implement the fix.
Secure SDLC mandates input validation and output encoding that directly prevent expression-language injection.
Application security requirements explicitly call for controls against injection flaws including EL injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
Secure coding standards require proper escaping and parameterization of expression-language statements.