{"id":"CVE-2022-26134","kind":"vulnerability","aliases":["CVE-2022-26134"],"related":[],"title":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow…","description":"Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.\n\nCISA required action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","summary":"Atlassian Confluence Server and Data Center has a remote code execution flaw that needs no login. An unauthenticated attacker can run code on the server, and the flaw is actively exploited in the wild, with ransomware use noted in the catalog.","severity":"critical","cvss":9.8,"epss":0.99999,"exploited":true,"exploited_at":"2022-06-02T00:00:00+00:00","products":[{"name":"Atlassian Confluence Server/Data Center","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["7.4.17"],"affected":">= 1.3, < 7.4.17","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["7.13.7"],"affected":">= 7.13.0, < 7.13.7","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["7.14.3"],"affected":">= 7.14.0, < 7.14.3","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["7.15.2"],"affected":">= 7.15.0, < 7.15.2","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["7.16.4"],"affected":">= 7.16.0, < 7.16.4","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":["7.17.4"],"affected":">= 7.17.0, < 7.17.4","ecosystem":"vendor"},{"name":"atlassian confluence data center","fixed":[],"affected":"= 7.18.0","ecosystem":"vendor"},{"name":"atlassian confluence server","fixed":["7.4.17"],"affected":">= 1.3, < 7.4.17","ecosystem":"vendor"},{"name":"atlassian confluence server","fixed":["7.13.7"],"affected":">= 7.13.0, < 7.13.7","ecosystem":"vendor"},{"name":"atlassian confluence server","fixed":["7.14.3"],"affected":">= 7.14.0, < 7.14.3","ecosystem":"vendor"},{"name":"atlassian confluence server","fixed":["7.15.2"],"affected":">= 7.15.0, < 7.15.2","ecosystem":"vendor"},{"name":"atlassian confluence server","fixed":["7.16.4"],"affected":">= 7.16.0, < 7.16.4","ecosystem":"vendor"},{"name":"atlassian confluence server","fixed":["7.17.4"],"affected":">= 7.17.0, < 7.17.4","ecosystem":"vendor"},{"name":"atlassian confluence server","fixed":[],"affected":"= 7.18.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["atlassian","confluence","exploited","java","package","ransomware","self-hosted"],"not_affected_if":["atlassian-cloud","not-server-or-data-center"],"how_to_check":"Check the Confluence version under Administration > System Information against the Atlassian advisory linked in the sources.\nLook for unexpected processes or new web shell files under the Confluence install directory.","fix":"Apply the update from the Atlassian security advisory dated 2022-06-02 (confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html), or remove the affected product.\nUntil patched, block all internet traffic to and from the affected Confluence servers, as CISA requires.","status":"open","published_at":"2022-06-02T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:59+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:12:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the update from the Atlassian security advisory dated 2022-06-02 (confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html), or remove the affected product.\nUntil patched, block all internet traffic to and from the affected Confluence servers, as CISA requires.","reach":"internet","impact":"high","summary":"Atlassian Confluence Server and Data Center has a remote code execution flaw that needs no login. An unauthenticated attacker can run code on the server, and the flaw is actively exploited in the wild, with ransomware use noted in the catalog.","category":"package","who_cares":["confluence","self-hosted","atlassian","java"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Confluence server without logging in.","analyst_note":"Sources do not list affected and fixed version ranges; check the Atlassian advisory linked in the CISA entry for exact versions and any IOCs.","how_to_check":"Check the Confluence version under Administration > System Information against the Atlassian advisory linked in the sources.\nLook for unexpected processes or new web shell files under the Confluence install directory.\nunknown","needs_analyst":true,"not_affected_if":["atlassian-cloud","not-server-or-data-center"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000544,"input_tokens":2964,"output_tokens":496,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':19A,22A '-26134':20A,23A '/doc/confluence-security-advisory-2022-06-02-1130377146.html]':172C 'action':152C 'activ':115B 'affect':2A,161C,176C 'agenc':192C 'allow':17A,140C 'appli':164C 'atlassian':24A,28A,32A,36A,40A,44A,48A,52A,56A,59A,62A,65A,68A,71A,74A,77B,86B,127C 'attack':104B,144C 'block':154C,197C 'catalog':126B 'center':9A,27A,31A,35A,39A,43A,47A,51A,55A,91B,132C 'cisa':150C 'code':95B,107B,136C,148C 'confluenc':5A,78B,87B,128C 'confluence':25A,29A,33A,37A,41A,45A,49A,53A,57A,60A,63A,66A,69A,72A,75A 'confluence.atlassian.com':171C 'confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html]':170C 'contain':133C 'cve':18A,21A 'data':8A,30A,34A,38A,42A,46A,50A,54A,90B,131C 'date':181C 'deploy':191C 'due':180C 'execut':96B,137C,149C 'exist':14A 'exploit':79B,116B 'flaw':97B,113B 'host':85B 'immedi':153C 'inject':12A 'instruct':169C 'internet':156C,196C 'java':80B 'login':101B 'need':99B 'note':123B,185C 'ognl':11A 'packag':81B 'per':167C 'perform':146C 'product':162C,177C 'ransomwar':82B,121B 'reassess':194C 'remot':94B,135C,147C 'remov':174C 'requir':151C 'right':184C 'rule':198C 'run':106B 'self':84B 'self-host':83B 'server':6A,58A,61A,64A,67A,70A,73A,76A,88B,110B,129C 'server/data':26A 'success':190C 'traffic':157C 'unauthent':103B,143C 'updat':166C,188C 'use':122B 'vendor':168C 'version':3A 'vulner':13A,138C 'wild':119B 'would':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-06-02T00:00:00+00:00","kev":{"dateAdded":"2022-06-02","dueDate":"2022-06-06","requiredAction":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26134","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26134","severity":null,"published_at":"2022-06-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2022-26134","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26134","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-26134","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26134","severity":null,"published_at":"2022-06-03T22:15:07+00:00","modified_at":"2026-06-17T04:34:44+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}