CVE-2022-26134criticalunder attackransomwareCWE-917

CVE-2022-26134: critical vulnerability in Atlassian Confluence Server

Published · Updated

Follow this CVE+ Monitor Confluence Server+ Monitor Confluence Data Center

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDJun 3
1st PoCMay 31
metasploitJun 2
CISA KEVJun 2
Action required by CISAfederal deadline: 2022-06-06

Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

In short

Confluence Server and Data Center have a critical flaw that allows anyone on the internet to run malicious code on the affected server without needing a password. This happens because the application improperly processes user input through OGNL (Object-Graph Navigation Language), a templating system.

Technical detail

An unauthenticated remote attacker can exploit an OGNL injection vulnerability (CWE-917) in Confluence Server and Data Center to achieve arbitrary code execution. The vulnerability stems from insufficient input validation in OGNL expression handling, allowing injection of malicious expressions that are evaluated server-side. This affects versions 1.3.0–7.4.16, 7.13.0–7.13.6, 7.14.0–7.14.2, 7.15.0–7.15.1, 7.16.0–7.16.3, 7.17.0–7.17.3, and 7.18.0.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Atlassian · Confluence Data CenterAtlassian · Confluence Server
public PoCs found — 146
exploitdbwww.exploit-db.com/exploits/50952unverifiedgithubgithub.com/W01fh4cker/Serein★ 1244githubgithub.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL★ 339githubgithub.com/jbaines-r7/through_the_wire★ 174githubgithub.com/hev0x/CVE-2022-26134★ 44githubgithub.com/crowsec-edtech/CVE-2022-26134★ 31githubgithub.com/nxtexploit/CVE-2022-26134★ 29githubgithub.com/SNCKER/CVE-2022-26134★ 26githubgithub.com/SIFalcon/confluencePot★ 20githubgithub.com/AmoloHT/CVE-2022-26134★ 14githubgithub.com/redhuntlabs/ConfluentPwn★ 13githubgithub.com/whokilleddb/CVE-2022-26134-Confluence-RCE★ 13githubgithub.com/iveresk/cve-2022-26134★ 12githubgithub.com/offlinehoster/CVE-2022-26134★ 8githubgithub.com/abhishekmorla/CVE-2022-26134★ 8githubgithub.com/MaskCyberSecurityTeam/CVE-2022-26134_Behinder_MemShell★ 8githubgithub.com/keven1z/CVE-2022-26134★ 7githubgithub.com/BBD-YZZ/Confluence-RCE★ 5githubgithub.com/Chocapikk/CVE-2022-26134★ 4githubgithub.com/Y000o/Confluence-CVE-2022-26134★ 4githubgithub.com/li8u99/CVE-2022-26134★ 4githubgithub.com/Debajyoti0-0/CVE-2022-26134★ 4githubgithub.com/archanchoudhury/Confluence-CVE-2022-26134★ 4githubgithub.com/kh4sh3i/CVE-2022-26134★ 4githubgithub.com/alcaparra/CVE-2022-26134★ 4githubgithub.com/cai-niao98/CVE-2022-26134★ 3githubgithub.com/Vulnmachines/Confluence-CVE-2022-26134★ 3githubgithub.com/skhalsa-sigsci/CVE-2022-26134-LAB★ 3githubgithub.com/KeepWannabe/BotCon★ 3githubgithub.com/kyxiaxiang/CVE-2022-26134★ 3githubgithub.com/cbk914/CVE-2022-26134_check★ 3githubgithub.com/f4yd4-s3c/cve-2022-26134★ 2githubgithub.com/twoning/CVE-2022-26134-PoC★ 2githubgithub.com/b4dboy17/CVE-2022-26134★ 2githubgithub.com/p4b3l1t0/confusploit★ 2githubgithub.com/Brucetg/CVE-2022-26134★ 2githubgithub.com/axingde/CVE-2022-26134★ 1githubgithub.com/CJ-0107/cve-2022-26134★ 1githubgithub.com/1337in/CVE-2022-26134web★ 1githubgithub.com/coskper-papa/CVE-2022-26134★ 1githubgithub.com/reubensammut/cve-2022-26134★ 1githubgithub.com/404fu/CVE-2022-26134-POC★ 1githubgithub.com/r1skkam/TryHackMe-Atlassian-CVE-2022-26134★ 1githubgithub.com/kelemaoya/CVE-2022-26134★ 1githubgithub.com/shamo0/CVE-2022-26134★ 1githubgithub.com/0xAgun/CVE-2022-26134★ 1githubgithub.com/acfirthh/CVE-2022-26134★ 1githubgithub.com/ColdFusionX/CVE-2022-26134★ 1githubgithub.com/kailing0220/CVE-2022-26134★ 1githubgithub.com/ma1am/CVE-2022-26134-Exploit-Detection★ 1githubgithub.com/Habib0x0/CVE-2022-26134★ 1githubgithub.com/vesperp/CVE-2022-26134-Confluence★ 0githubgithub.com/Muhammad-Ali007/Atlassian_CVE-2022-26134★ 0githubgithub.com/Khalidhaimur/CVE-2022-26134★ 0githubgithub.com/MAHABUB122003/Atlassian-CVE-2022-26134★ 0githubgithub.com/roodhelios/CVE-2022-26134-OGNL-Injection★ 0githubgithub.com/sunny-kathuria/exploit_CVE-2022-26134★ 0githubgithub.com/Luchoane/CVE-2022-26134_conFLU★ 0githubgithub.com/yyqxi/CVE-2022-26134★ 0githubgithub.com/cc3305/CVE-2022-26134★ 0githubgithub.com/Gilospy/CVE-2022-26134★ 0githubgithub.com/secjia/CVE-2022-26134★ 0githubgithub.com/yTxZx/CVE-2022-26134★ 0githubgithub.com/xsxtw/CVE-2022-26134★ 0githubgithub.com/crypt0lith/confluence-ognl-rce★ 0githubgithub.com/RootEvil333/CVE-2022-26134★ 0githubgithub.com/latings/CVE-2022-26134★ 0githubgithub.com/tpdlshdmlrkfmcla/cve-2022-26134★ 0githubgithub.com/wjlin0/CVE-2022-26134★ 0githubgithub.com/shiftsansan/CVE-2022-26134-Console★ 0githubgithub.com/thetowsif/CVE-2022-26134★ 0githubgithub.com/yigexioabai/CVE-2022-26134-cve1★ 0githubgithub.com/xanszZZ/ATLASSIAN-Confluence_rce★ 0githubgithub.com/DARKSTUFF-LAB/-CVE-2022-26134★ 0vulncheckvulncheck.com/xdb/d0540ce1cb8dunverifiedvulncheckvulncheck.com/xdb/afb357664032unverifiedvulncheckvulncheck.com/xdb/36e25b480581unverifiedvulncheckvulncheck.com/xdb/68a67174cffbunverifiedvulncheckvulncheck.com/xdb/b0ddf8e8e190unverifiedvulncheckvulncheck.com/xdb/e68dc3f67ff5unverifiedvulncheckvulncheck.com/xdb/0e38e7f0c998unverifiedvulncheckvulncheck.com/xdb/ccf22111c515unverifiedvulncheckvulncheck.com/xdb/4dd293ad4c62unverifiedvulncheckvulncheck.com/xdb/546df2d43760unverifiedvulncheckvulncheck.com/xdb/66716e60c64aunverifiedvulncheckvulncheck.com/xdb/33ae84bef451unverifiedvulncheckvulncheck.com/xdb/4a62fb975d25unverifiedvulncheckvulncheck.com/xdb/6e3b669985c0unverifiedvulncheckvulncheck.com/xdb/610e8ac40120unverifiedvulncheckvulncheck.com/xdb/b8975356b7ecunverifiedvulncheckvulncheck.com/xdb/6f9382355146unverifiedvulncheckvulncheck.com/xdb/5b4caf96d2c6unverifiedvulncheckvulncheck.com/xdb/86443907f2d8unverifiedvulncheckvulncheck.com/xdb/9fecf5c3535aunverifiedvulncheckvulncheck.com/xdb/d8d2a4e09b27unverifiedvulncheckvulncheck.com/xdb/aa3c74a7faf0unverifiedvulncheckvulncheck.com/xdb/61805bb30396unverifiedvulncheckvulncheck.com/xdb/090edbfc3023unverifiedvulncheckvulncheck.com/xdb/842a7b278086unverifiedvulncheckvulncheck.com/xdb/addd382b1e54unverifiedvulncheckvulncheck.com/xdb/eb21e9bfe5ebunverifiedvulncheckvulncheck.com/xdb/3e4ac0104159unverifiedvulncheckvulncheck.com/xdb/6faa1c9d88f6unverifiedvulncheckvulncheck.com/xdb/6e612cea3ddaunverifiedvulncheckvulncheck.com/xdb/d673882b1749unverifiedvulncheckvulncheck.com/xdb/39e06de0be1funverifiedvulncheckvulncheck.com/xdb/c75d37232bc3unverifiedvulncheckvulncheck.com/xdb/dc2f3c02f8d4unverifiedvulncheckvulncheck.com/xdb/14047453ba17unverifiedvulncheckvulncheck.com/xdb/628331d44c34unverifiedvulncheckvulncheck.com/xdb/84304f834234unverifiedvulncheckvulncheck.com/xdb/648550535509unverifiedvulncheckvulncheck.com/xdb/bf4a212e429bunverifiedvulncheckvulncheck.com/xdb/556ef02d9595unverifiedvulncheckvulncheck.com/xdb/fe6b0b57fa24unverifiedvulncheckvulncheck.com/xdb/f1b043c20876unverifiedvulncheckvulncheck.com/xdb/2d3e861a0832unverifiedvulncheckvulncheck.com/xdb/3ad15a0e2ac3unverifiedcve_referencepacketstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlunverifiedvulncheckvulncheck.com/xdb/8974c552a2e5unverifiedvulncheckvulncheck.com/xdb/a43aebbe5a90unverifiedvulncheckvulncheck.com/xdb/3d93a29f925bunverifiedvulncheckvulncheck.com/xdb/6bc3d8b79311unverifiedvulncheckvulncheck.com/xdb/2c33af279252unverifiedvulncheckvulncheck.com/xdb/ca9e684d7a83unverifiedcve_referencepacketstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/eda8223e977dunverifiedvulncheckvulncheck.com/xdb/500036fec42eunverifiedvulncheckvulncheck.com/xdb/780c87a82988unverifiedvulncheckvulncheck.com/xdb/ab530000a4e4unverifiedvulncheckvulncheck.com/xdb/414ebc87cd3bunverifiedvulncheckvulncheck.com/xdb/e4386919f2b9unverifiedvulncheckvulncheck.com/xdb/3786abbc3b80unverifiedvulncheckvulncheck.com/xdb/7335c8b64e5aunverifiedvulncheckvulncheck.com/xdb/4162abbf3203unverifiedvulncheckvulncheck.com/xdb/c15ae388f037unverifiedvulncheckvulncheck.com/xdb/827f3f601d2aunverifiedvulncheckvulncheck.com/xdb/c04e3752492bunverifiedvulncheckvulncheck.com/xdb/4131279556d5unverifiedvulncheckvulncheck.com/xdb/13d8edcd31c1unverifiedvulncheckvulncheck.com/xdb/a518d737580dunverifiedcve_referencepacketstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlunverifiedvulncheckvulncheck.com/xdb/bef9a90a6d01unverifiedvulncheckvulncheck.com/xdb/88cd3575ffb8unverifiedcve_referencepacketstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlunverifiedvulncheckvulncheck.com/xdb/4221888e84f0unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Confluence Server

In the same product, most dangerous first.

CVE-2023-22518CRITICALCVE-2023-22518EPSS 100.0%KEVCVE-2021-26084CRITICALCVE-2021-26084EPSS 100.0%KEVCVE-2023-22527CRITICALCVE-2023-22527EPSS 100.0%KEVCVE-2021-26085MEDIUMCVE-2021-26085EPSS 99.9%KEVCVE-2019-3396CRITICALCVE-2019-3396EPSS 99.9%KEVCVE-2026-21589CRITICALCVE-2026-21589EPSS 99.7%KEV