HackerFeeds
All CVEs

CVE-2022-26134

CRITICAL9.8
CISA KEV

Published 2022-06-03 · Updated 2026-06-17 · Source security@atlassian.com

Summary

CVE-2022-26134 is a critical-severity (CVSS 9.8) vulnerability in Atlassian Confluence Server/Data Center. CISA added it to the Known Exploited Vulnerabilities catalog on June 2, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 6, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Atlassian has 14 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

All 14 known-exploited Atlassian vulnerabilities →

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-917CWE-917

CISA Known-Exploited Vulnerability

Product: Atlassian — Confluence Server/Data Center

Name: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Date added: 2022-06-02 · Due: 2022-06-06

USED IN RANSOMWARE

Required action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

References

View on NVD