---
id: "CVE-2022-26134"
kind: "vulnerability"
aliases: ["CVE-2022-26134"]
title: "In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow\u2026"
severity: "critical"
cvss: 9.8
epss: 0.99999
exploited: true
status: "open"
category: "package"
products: [{"name": "Atlassian Confluence Server/Data Center", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["7.4.17"], "affected": ">= 1.3, < 7.4.17", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["7.13.7"], "affected": ">= 7.13.0, < 7.13.7", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["7.14.3"], "affected": ">= 7.14.0, < 7.14.3", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["7.15.2"], "affected": ">= 7.15.0, < 7.15.2", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["7.16.4"], "affected": ">= 7.16.0, < 7.16.4", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["7.17.4"], "affected": ">= 7.17.0, < 7.17.4", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": [], "affected": "= 7.18.0", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["7.4.17"], "affected": ">= 1.3, < 7.4.17", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["7.13.7"], "affected": ">= 7.13.0, < 7.13.7", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["7.14.3"], "affected": ">= 7.14.0, < 7.14.3", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["7.15.2"], "affected": ">= 7.15.0, < 7.15.2", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["7.16.4"], "affected": ">= 7.16.0, < 7.16.4", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["7.17.4"], "affected": ">= 7.17.0, < 7.17.4", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": [], "affected": "= 7.18.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["atlassian", "confluence", "exploited", "java", "package", "ransomware", "self-hosted"]
not_affected_if: ["atlassian-cloud", "not-server-or-data-center"]
published_at: "2022-06-02T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26134", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26134", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26134", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow…

Atlassian Confluence Server and Data Center has a remote code execution flaw that needs no login. An unauthenticated attacker can run code on the server, and the flaw is actively exploited in the wild, with ransomware use noted in the catalog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Confluence Server/Data Center affected ? fixed ?
- vendor:atlassian confluence data center affected >= 1.3, < 7.4.17 fixed 7.4.17
- vendor:atlassian confluence data center affected >= 7.13.0, < 7.13.7 fixed 7.13.7
- vendor:atlassian confluence data center affected >= 7.14.0, < 7.14.3 fixed 7.14.3
- vendor:atlassian confluence data center affected >= 7.15.0, < 7.15.2 fixed 7.15.2
- vendor:atlassian confluence data center affected >= 7.16.0, < 7.16.4 fixed 7.16.4
- vendor:atlassian confluence data center affected >= 7.17.0, < 7.17.4 fixed 7.17.4
- vendor:atlassian confluence data center affected = 7.18.0 fixed ?
- vendor:atlassian confluence server affected >= 1.3, < 7.4.17 fixed 7.4.17
- vendor:atlassian confluence server affected >= 7.13.0, < 7.13.7 fixed 7.13.7
- vendor:atlassian confluence server affected >= 7.14.0, < 7.14.3 fixed 7.14.3
- vendor:atlassian confluence server affected >= 7.15.0, < 7.15.2 fixed 7.15.2
- vendor:atlassian confluence server affected >= 7.16.0, < 7.16.4 fixed 7.16.4
- vendor:atlassian confluence server affected >= 7.17.0, < 7.17.4 fixed 7.17.4
- vendor:atlassian confluence server affected = 7.18.0 fixed ?

## How to check

Check the Confluence version under Administration > System Information against the Atlassian advisory linked in the sources.
Look for unexpected processes or new web shell files under the Confluence install directory.

## Fix

Apply the update from the Atlassian security advisory dated 2022-06-02 (confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html), or remove the affected product.
Until patched, block all internet traffic to and from the affected Confluence servers, as CISA requires.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26134
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-26134
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26134

## From the sources

Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.

CISA required action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_