CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Description
CVE-2022-26134 is a critical remote code execution vulnerability in Atlassian Confluence Server and Data Center that allows an unauthenticated attacker to execute arbitrary code on the target system. The vulnerability exploits an OGNL injection flaw in Confluence's web interface, enabling attackers to gain full control of the server without any authentication. CVE-2022-26134 has been listed in CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware association, and its EPSS percentile of 99.98% indicates near-certain exploitation activity. This Confluence vulnerability has been widely exploited in ransomware campaigns and represents an immediate threat to any organization running unpatched Confluence instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | confluence data center | >= 1.3, < 7.4.17; >= 7.13.0, < 7.13.7; >= 7.14.0, < 7.14.3; >= 7.15.0, < 7.15.2; >= 7.16.0, < 7.16.4; >= 7.17.0, < 7.17.4; 7.18.0 |
| atlassian | confluence server | >= 1.3, < 7.4.17; >= 7.13.0, < 7.13.7; >= 7.14.0, < 7.14.3; >= 7.15.0, < 7.15.2; >= 7.16.0, < 7.16.4; >= 7.17.0, < 7.17.4; 7.18.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html(Vendor Advisory)
- https://jira.atlassian.com/browse/CONFSERVER-79016(Issue Tracking, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2022-26134 in the NVD database. The underlying weakness is an OGNL (Object-Graph Navigation Language) injection vulnerability in Atlassian Confluence Server and Data Center. OGNL injection allows attackers to evaluate arbitrary expressions on the server side by injecting malicious OGNL code through user-controlled input, resulting in remote code execution. This class of vulnerability is closely related to expression language injection and server-side code injection.
Learn more: CWE Overview
Impact Analysis
CVE-2022-26134 has a devastating impact profile as it allows unauthenticated remote code execution on Confluence servers. The vulnerability is remotely exploitable without physical access, requires no special conditions or authentication, and demands no user interaction, making it trivially exploitable at scale. Confidentiality (High): Attackers gain access to all data stored in Confluence, including proprietary documentation, internal wikis, credentials, API keys, and sensitive business information. Integrity (High): Full code execution enables attackers to modify Confluence content, install webshells, implant backdoors, and alter server configurations. Availability (High): Compromised servers can be encrypted by ransomware, taken offline, or used as pivot points for further attacks. CISA has confirmed ransomware association with this vulnerability, and the EPSS percentile of 99.98% places it among the most actively exploited vulnerabilities in existence.
Exploit Maturity
CVE-2022-26134 has an extremely high exploit maturity with widespread active exploitation confirmed. CISA included this vulnerability in the KEV catalog with an urgent remediation deadline of June 6, 2022, and noted that all internet traffic to and from affected products should be immediately blocked. Ransomware association is confirmed by CISA, with multiple ransomware groups leveraging this vulnerability for initial access. The EPSS percentile of 99.98% places CVE-2022-26134 among the most actively exploited vulnerabilities tracked, indicating near-certain exploitation activity. Public exploit code is widely available, and the vulnerability was exploited as a zero-day before patches were released, with mass exploitation campaigns observed across diverse industries and geographies.
Remediation
- Immediately block all internet traffic to and from affected Confluence instances and apply the update per Atlassian's security advisory at https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html. As stated in the CISA KEV required action, internet blocking should remain in place until updates are successfully deployed.
- Upgrade Confluence Server and Data Center to a patched version immediately. Atlassian released fixes for all supported versions. If running an unsupported version, upgrade to a supported release that includes the security fix.
- Scan for indicators of compromise on affected Confluence servers. Look for webshells, unauthorized user accounts, unexpected scheduled tasks, and suspicious process execution. Review access logs for exploitation attempts targeting OGNL injection patterns.
- Implement web application firewall (WAF) rules to detect and block OGNL injection patterns in HTTP requests. While not a substitute for patching, WAF rules provide an additional defense layer against exploitation attempts.
- Restrict network access to Confluence to trusted networks only. Confluence should not be directly exposed to the internet without proper access controls, reverse proxy authentication, and VPN requirements.
Technical Details
CVE-2022-26134 is an OGNL injection vulnerability in Atlassian Confluence Server and Data Center. The vulnerability exists in the way Confluence processes certain HTTP requests, allowing an attacker to inject arbitrary OGNL expressions that are evaluated on the server side. OGNL is a powerful expression language used internally by Confluence's Struts-based framework, and when attacker-controlled input reaches the OGNL evaluation engine without proper sanitization, it enables direct execution of Java code on the server. The attack requires only a specially crafted HTTP request to a Confluence URL, with no authentication or user interaction needed. The injected OGNL expression can invoke Java runtime methods to execute operating system commands, read files, establish reverse shells, or download and execute additional payloads. The simplicity of the exploit combined with the ubiquity of internet-facing Confluence instances made this vulnerability particularly devastating.
Frequently Asked Questions
Is CVE-2022-26134 being actively exploited?
Yes, CVE-2022-26134 is actively and widely exploited. CISA confirmed active exploitation and added it to the KEV catalog with ransomware association. The EPSS percentile of 99.98% indicates near-certain exploitation activity, and multiple ransomware groups have leveraged this vulnerability for initial access to enterprise networks.
What products are affected by CVE-2022-26134?
CVE-2022-26134 affects Atlassian Confluence Server and Atlassian Confluence Data Center. All versions prior to the security fix are vulnerable. Organizations running self-hosted Confluence instances should verify their version against the Atlassian security advisory to determine if they are affected.
How do I fix CVE-2022-26134?
Immediately block all internet traffic to affected Confluence instances and apply the vendor-provided patches from Atlassian's security advisory. Upgrade to a patched version of Confluence Server or Data Center. After patching, scan for indicators of compromise including webshells and unauthorized accounts, as the system may have already been exploited.
How severe is CVE-2022-26134?
CVE-2022-26134 is a critical unauthenticated remote code execution vulnerability with an EPSS percentile of 99.98%, placing it among the most exploited vulnerabilities globally. CISA confirmed ransomware association and set an urgent remediation deadline of June 6, 2022. The combination of no authentication requirement and trivial exploitability makes this one of the most dangerous Confluence vulnerabilities ever disclosed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.