CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability - [Actively Exploited]
Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
INFO
Published Date :
June 3, 2022, 10:15 p.m.
Last Modified :
Oct. 24, 2025, 1:38 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Known Detected Jun 02, 2022
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Affected Products
The following products are affected by CVE-2022-26134
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 2.0 | HIGH | [email protected] | ||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Upgrade to Atlassian Confluence version 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or later.
- Prioritize patching or updating to address this actively exploited vulnerability.
Public PoC/Exploit Available at Github
CVE-2022-26134 has a 270 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-26134.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-26134 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-26134
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
HTML
None
HTML
None
Python
AI?????/?????????????? | AI-powered framework/middleware vulnerability verification platform
Dockerfile Python HTML JavaScript CSS
AI驱动的Web漏洞扫描引擎 | 115+ POC | OWASP Top10 + 30+国产信创软件 | Ghost Bits编码绕过WAF | Nuclei兼容 | 插件化架构
Python
CyberGuard is a professional JavaFX desktop vulnerability scanner featuring an 8-phase scan engine, 15+ real CVEs, live terminal output, severity dashboard, remediation panel, and CSV export — built with async multithreading to keep the UI fully responsive. Java 17+, no cloud required.
A domain-aware consistency defense system that detects knowledge-base poisoning attacks in RAG pipelines by cross-referencing LLM-generated CVE answers against the NIST National Vulnerability Database (NVD).
Jupyter Notebook Python
Automated penetration testing framework for IP-connected devices (IoT, routers, IP cameras, OT/ICS) — PyQt6 GUI + CLI, 9 exploit modules, CVE database
Python
None
Go HTML JavaScript CSS TypeScript
HTTP honeypot on autopilot
canarytokens deception deception-technology honeypot honeypots codex llm-security openai
Python
cyber Security write-ups
Kumo 蜘蛛 is a domain OSINT & security reconnaissance framework. Drop a domain, get everything back in real time across 21 parallel modules: DNS, open ports, leaked credentials, infostealer infections, vulnerable endpoints, subdomains, CVEs, malware families, and more.(Beta)
cybersecurity domain-scanner hacking osint pentesting python recon security-tools breach-intelligence bugbounty subdomain-enumeration
Python
Educational terminal hacking campaign (safe, sandbox). CLI + browser alpha — Node 18+, MIT.
JavaScript HTML CSS PowerShell
None
Dockerfile Python PHP
A comprehensive cyber attack analysis and detection project focusing on identifying vulnerabilities, simulating attacks, and implementing security measures using data-driven techniques.
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-26134 vulnerability anywhere in the article.
-
Help Net Security
Initial access broker pleads guilty to selling access to 50 corporate networks
A 40-year-old Jordanian man has admitted to selling unauthorized access to computer networks of at least 50 companies, the US Attorney’s Office of the District of New Jersey has announced. Feras Khali ... Read more
-
CybersecurityNews
2.5 Million+ Malicious Request From Hackers Attacking Adobe ColdFusion Servers
A coordinated exploitation campaign that generated more than 2.5 million malicious requests against Adobe ColdFusion servers and 47+ other technology platforms during the Christmas 2025 holiday period ... Read more
-
Daily CyberSecurity
China APT Infiltrates US Policy Nonprofit in Months-Long Espionage Campaign Using DLL Sideloading
A new investigation by the Broadcom Threat Hunter Team has uncovered a China-linked cyber espionage campaign that infiltrated a U.S.-based nonprofit organization involved in influencing U.S. governmen ... Read more
-
The Hacker News
From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools
A China-linked threat actor has been attributed to a cyber attack targeting an U.S. non-profit organization with an aim to establish long-term persistence, as part of broader activity aimed at U.S. en ... Read more
-
CybersecurityNews
Chinese Hackers Organization Influence U.S. Government Policy on International Issues
China-linked threat actors have intensified their focus on influencing American governmental decision-making processes by targeting organizations involved in shaping international policy. In April 202 ... Read more
-
Cyber Security News
23 Vulnerabilities in Black Basta’s Chat Logs Exploited in the Wild, Including PAN-OS, Cisco IOS, & Exchange
GreyNoise has confirmed active exploitation of 23 out of 62 vulnerabilities referenced in internal chat logs attributed to the Black Basta ransomware group. These vulnerabilities span enterprise softw ... Read more
-
The Cyber Express
Black Basta Chat Logs Reveal Ransomware Group’s TTPs, IoCs
The Black Basta ransomware group has fallen off dramatically in 2025, and chat logs leaked recently show that internal squabbling may be behind the group’s slowed activity. Cyble threat intelligence r ... Read more
-
AttackIQ
Response to CISA Advisory (AA24-317A): 2023 Top Routinely Exploited Vulnerabilities
On November 12, 2024, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) released a Cybersecurity Advisory (CSA) providing details on the Common Vulnerabilities and Exposures (CVEs) routin ... Read more
-
security.nl
VS publiceert overzicht van meest misbruikte kwetsbaarheden in 2023
De Amerikaanse autoriteiten hebben samen met cyberagentschappen uit Australië, Canada, Nieuw-Zeeland en het Verenigd Koninkrijk een overzicht van de meest misbruikte kwetsbaarheden in 2023 opgesteld. ... Read more
-
The Register
US charges Russian GRU hackers behind WhisperGate intrusions
The US today charged five Russian military intelligence officers and one civilian for their alleged involvement with the data-wiping WhisperGate campaign conducted against Ukraine in January 2022 befo ... Read more
-
Darktrace
Confluence CVE-2022-26134 Zero-Day: Detection & Guidance
What is WarmCookie malware?WarmCookie, also known as BadSpace [2], is a two-stage backdoor tool that provides functionality for threat actors to retrieve victim information and launch additional paylo ... Read more
The following table lists the changes that have been made to the
CVE-2022-26134 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Oct. 24, 2025
Action Type Old Value New Value Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134 Types: US Government Resource -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 22, 2025
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 21, 2025
Action Type Old Value New Value Removed Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 21, 2025
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134 -
Modified Analysis by [email protected]
Feb. 09, 2025
Action Type Old Value New Value -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Feb. 04, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-917 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html Added Reference http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html Added Reference http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html Added Reference http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html Added Reference https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html Added Reference https://jira.atlassian.com/browse/CONFSERVER-79016 -
Modified Analysis by [email protected]
Jun. 28, 2024
Action Type Old Value New Value Changed Reference Type https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html No Types Assigned https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html Vendor Advisory Changed Reference Type https://jira.atlassian.com/browse/CONFSERVER-79016 Patch, Vendor Advisory https://jira.atlassian.com/browse/CONFSERVER-79016 Issue Tracking, Patch, Vendor Advisory -
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
CWE Remap by [email protected]
Aug. 08, 2023
Action Type Old Value New Value Changed CWE CWE-74 CWE-917 -
CVE Modified by [email protected]
Jun. 30, 2022
Action Type Old Value New Value Added Reference https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html [No Types Assigned] -
Initial Analysis by [email protected]
Jun. 14, 2022
Action Type Old Value New Value Added CVSS V2 NIST (AV:N/AC:L/Au:N/C:P/I:P/A:P) Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Changed Reference Type http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html No Types Assigned http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry Changed Reference Type http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html No Types Assigned http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html Third Party Advisory, VDB Entry Changed Reference Type http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html No Types Assigned http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html Third Party Advisory, VDB Entry Changed Reference Type http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html No Types Assigned http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html Exploit, Third Party Advisory, VDB Entry Changed Reference Type https://jira.atlassian.com/browse/CONFSERVER-79016 No Types Assigned https://jira.atlassian.com/browse/CONFSERVER-79016 Patch, Vendor Advisory Added CWE NIST CWE-74 Added CPE Configuration OR *cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* versions from (including) 1.3 up to (excluding) 7.4.17 *cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* versions from (including) 7.13.0 up to (excluding) 7.13.7 *cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* versions from (including) 7.14.0 up to (excluding) 7.14.3 *cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* versions from (including) 7.15.0 up to (excluding) 7.15.2 *cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* versions from (including) 7.16.0 up to (excluding) 7.16.4 *cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* versions from (including) 7.17.0 up to (excluding) 7.17.4 *cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:* *cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* versions from (including) 1.3 up to (excluding) 7.4.17 *cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* versions from (including) 7.13.0 up to (excluding) 7.13.7 *cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* versions from (including) 7.14.0 up to (excluding) 7.14.3 *cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* versions from (including) 7.15.0 up to (excluding) 7.15.2 *cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* versions from (including) 7.16.0 up to (excluding) 7.16.4 *cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* versions from (including) 7.17.0 up to (excluding) 7.17.4 *cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:* -
CVE Modified by [email protected]
Jun. 08, 2022
Action Type Old Value New Value Added Reference http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html [No Types Assigned] -
CVE Modified by [email protected]
Jun. 08, 2022
Action Type Old Value New Value Added Reference http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html [No Types Assigned] Added Reference http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html [No Types Assigned] Added Reference http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html [No Types Assigned]