CVE-2023-22518

CRITICAL9.8

CISA KEV

Published 2023-10-31 · Updated 2026-06-17 · Source security@atlassian.com

Summary

CVE-2023-22518 is a critical-severity (CVSS 9.8) vulnerability in Atlassian Confluence Data Center and Server. CISA added it to the Known Exploited Vulnerabilities catalog on November 7, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 28, 2023. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Atlassian has 14 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

All 14 known-exploited Atlassian vulnerabilities →

Description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-863CWE-863

CISA Known-Exploited Vulnerability

Product: Atlassian — Confluence Data Center and Server

Name: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Date added: 2023-11-07 · Due: 2023-11-28

USED IN RANSOMWARE

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Atlassian vulnerabilities

Most recently added to CISA KEV

CVE-2026-21589
Multiple Products — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
added 2026-10-15
CVE-2021-26086
Jira Server and Data Center — Atlassian Jira Server and Data Center Path Traversal Vulnerability
added 2024-11-12
CVE-2023-22527
RANSOMWARE
Confluence Data Center and Server — Atlassian Confluence Data Center and Server Template Injection Vulnerability
added 2024-01-24
CVE-2023-22515
RANSOMWARE
Confluence Data Center and Server — Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
added 2023-10-05
CVE-2022-36804
Bitbucket Server and Data Center — Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
added 2022-09-30
CVE-2022-26138
Confluence — Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
added 2022-07-29

View all →

Related CVEs

Same severity, most recent

CVE-2026-124060
A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
2026-11-07 · score 9.1
CVE-2026-124059
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
2026-11-07 · score 9.1
CVE-2026-124058
A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
2026-11-07 · score 9.1
CVE-2026-124057
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
2026-11-07 · score 9.1
CVE-2026-123966
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
2026-11-07 · score 10.0