{"id":"CVE-2022-26134","published":"2022-06-03T22:15:07Z","modified":"2026-06-17T04:34:44Z","title":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","vendor":"Atlassian","product":"Confluence Server/Data Center","tier":"core","eol":null,"description":{"text":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an OGNL injection vulnerability in Atlassian Confluence Server and Data Center, in affected versions from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. An unauthenticated attacker with network access to a vulnerable instance can execute arbitrary code on the server, with no authentication or user interaction required and no special configuration needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:16Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99993,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-06-02","dueDate":"2022-06-06","ransomware":true,"requiredAction":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26134","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-06","exploitedFirstSeen":"2022-03-06","ransomware":true,"evidence":[{"url":"https://www.countercraftsec.com/blog/active-exploitation-of-confluence-cve-2022-26134/","date":"2022-03-06"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2022-05-31"},{"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html","date":"2022-06-02"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-02"},{"url":"https://unit42.paloaltonetworks.com/cve-2022-26134-atlassian-code-execution-vulnerability/","date":"2022-06-03"},{"url":"https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/","date":"2022-06-07"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://www.akamai.com/blog/security/atlassian-confluence-vulnerability-observations","date":"2022-06-28"},{"url":"https://www.aquasec.com/blog/8220-gang-confluence-vulnerability-cve-2022-26134/","date":"2022-07-07"}],"evidenceTotal":1118,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-917","name":"Improper Neutralization of Special Elements used in an Expression Language Statement"}],"references":[{"url":"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html","tags":["Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-79016","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html","tags":["Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-79016","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by placing a payload in the URI of an HTTP request to a public-facing server.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-2d837626646164f2ad77","title":"Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/","date":"2023-09-14","mentions":[{"quote":"CVE-2022-26134 is a remote code execution vulnerability in Confluence Server and Data Center.","start":8236,"end":8329},{"quote":"Recommendations that help organizations protect against exploitation of multiple vulnerabilities, including CVE-2022-26134, can be found in the recommendations section of this report.","start":8330,"end":8513},{"quote":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134","start":18940,"end":19001}]},{"id":"SRC-cb049733b1fc717427aa","title":"Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure","publisher":"cisa.gov","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf","date":null,"mentions":[{"quote":" CVE-2022-26134 (Atlassian Confluence Server and Data Center)","start":10341,"end":10403},{"quote":"the Wire is a proof of concept[14] exploit for CVE-2022-26134, an OGNL injection vulnerability","start":16320,"end":16414},{"quote":"CVE-2021-33044, CVE-2021-33045, CVE-2022-26134, and CVE-2022-","start":25317,"end":25378},{"quote":"The proof of concept exploit for CVE-2022-26134, Through the Wire, has","start":25388,"end":25458},{"quote":": Russia Cyber Threat Overview and Advisories\r\n MITRE: Group G1003 - Ember Bear\r\n MITRE: Impacket\r\n NIST NVD: CVE-2020-1472\r\n NIST NVD: CVE-2021-26084\r\n NIST NVD: CVE-2021-3156\r\n NIST NVD: CVE-2021-4034\r\n NIST NVD: CVE-2022-27666\r\n NIST NVD: CVE-2021-33044\r\n NIST NVD: CVE-2021-33045\r\n NIST NVD: CVE-2022-26134","start":36753,"end":37073}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-30701","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-30701","exploited":true,"exploitedSince":"2022-06-02","provenance":"source"},"exploits":[{"id":50952,"url":"https://www.exploit-db.com/exploits/50952","title":"Confluence Data Center 7.18.0 - Remote Code Execution (RCE)","type":"webapps","platform":"java","date":"2022-06-10","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-06-10"},"pocGithub":{"count":64,"skipped":8,"earliest":"2022-05-31","earliestUrl":"https://github.com/W01fh4cker/Serein","repos":[{"name":"W01fh4cker/Serein","url":"https://github.com/W01fh4cker/Serein","stars":1244,"created":"2022-05-31"},{"name":"BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL","url":"https://github.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL","stars":339,"created":"2022-06-07"},{"name":"jbaines-r7/through_the_wire","url":"https://github.com/jbaines-r7/through_the_wire","stars":174,"created":"2022-06-03"},{"name":"hev0x/CVE-2022-26134","url":"https://github.com/hev0x/CVE-2022-26134","stars":44,"created":"2022-06-06"},{"name":"crowsec-edtech/CVE-2022-26134","url":"https://github.com/crowsec-edtech/CVE-2022-26134","stars":31,"created":"2022-06-03"}]},"metasploit":[{"name":"Atlassian Confluence Namespace OGNL Injection","module":"exploit/multi/http/atlassian_confluence_namespace_ognl_injection","type":"exploit","disclosureDate":"2022-06-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb"}],"nuclei":[{"id":"CVE-2022-26134","name":"Confluence - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-26134.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26134.yaml"}],"first":{"date":"2022-05-31","source":"PoC-in-GitHub","url":"https://github.com/W01fh4cker/Serein"},"provenance":"source"},"detections":{"cveRules":[{"title":"Atlassian Confluence CVE-2022-26134","id":"7fb14105-530e-4e2e-8cfb-99f7d8700b66","level":"high","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-26134/proc_creation_lnx_exploit_cve_2022_26134_atlassian_confluence.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-26134/proc_creation_lnx_exploit_cve_2022_26134_atlassian_confluence.yml","techniques":["T1190","T1059"]},{"title":"Java Payload Strings","id":"583aa0a2-30b1-4d62-8bf3-ab73689efe6c","level":"high","status":"test","path":"rules/web/webserver_generic/web_java_payload_in_access_logs.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_java_payload_in_access_logs.yml","techniques":["T1190"]},{"title":"Potential OGNL Injection Exploitation In JVM Based Application","id":"4d0af518-828e-4a04-a751-a7d03f3046ad","level":"high","status":"test","path":"rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html","http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"}],"timeline":[{"date":"2022-03-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.countercraftsec.com/blog/active-exploitation-of-confluence-cve-2022-26134/","provenance":"source"},{"date":"2022-05-31","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2022-06-02, Exploit-DB 2022-06-10","url":"https://github.com/W01fh4cker/Serein","provenance":"source"},{"date":"2022-06-02","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-30701","provenance":"source"},{"date":"2022-06-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26134","provenance":"source"},{"date":"2023-09-14","kind":"report","label":"Named in microsoft.com: Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets","url":"https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1700 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 2 NVD exploit links; 64 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}