CVE-2022-26134
At a glance Severity CRITICAL 9.8 Exploitation Known exploited (CISA KEV) · added 2022-06-02 Exploited per ENISA since 2022-06-02 EPSS EPSS 100.00 % · percentile 100 (2026-10-27) State PUBLISHED Published 2022-06-03 Updated 2025-10-21 Assigner atlassian NVD status Analyzed Description In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 1.3 < 7.4.17cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.13.0 < 7.13.7cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.14.0 < 7.14.3cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.15.0 < 7.15.2cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.16.0 < 7.16.4cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.17.0 < 7.17.4cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 1.3 < 7.4.17cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.13.0 < 7.13.7cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.14.0 < 7.14.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.15.0 < 7.15.2cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.16.0 < 7.16.4cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.17.0 < 7.17.4cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*Affected products Product Versions Atlassian · Confluence Data Center affected next of 1.3.0 < unspecified ; affected unspecified < 7.4.17 ; affected 7.13.0 < unspecified ; affected unspecified < 7.13.7 ; affected 7.14.0 < unspecified ; affected unspecified < 7.14.3 Atlassian · Confluence Server affected next of 1.3.0 < unspecified ; affected unspecified < 7.4.17 ; affected 7.13.0 < unspecified ; affected unspecified < 7.13.7 ; affected 7.14.0 < unspecified ; affected unspecified < 7.14.3
References
Sources
