Vulnerability Intelligence

CVE-2022-26134

Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns

Published
Last modified
NVD status
Analyzed

CISA KEV catalog

Confirmed active exploitation.

Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.

CISA KEV
Name
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Affected products

atlassian: confluence data center; atlassian: confluence server

References10

Metrics

CVSS 3.1
9.8 CRITICAL Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
100% percentile: 100 · as of 2 November 2026
CWE
CWE-917