CVE-2022-26134
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists...
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
- Record
CVE-2022-26134- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-917
- Updated
- 2026-11-02
CVE List
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
- Record
CVE-2022-26134- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
EUVDEUVD-2022-30701
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
- Record
EUVD-2022-30701- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-653m-wpjp-54c4
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists...
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
- Record
GHSA-653m-wpjp-54c4- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74, CWE-917
- Updated
- 2026-11-02
CISA KEV No score
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
- Record
CVE-2022-26134- Weakness
- CWE-917
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | W01fh4cker/Serein | 2022-05-31 |
| Metasploit | Atlassian Confluence Namespace OGNL Injection | 2022-06-02 |
| PoC in GitHub | crowsec-edtech/CVE-2022-26134 | 2022-06-03 |
| PoC in GitHub | jbaines-r7/through_the_wire | 2022-06-03 |
| PoC in GitHub | ma1am/CVE-2022-26134-Exploit-Detection | 2022-06-03 |
| PoC in GitHub | offlinehoster/CVE-2022-26134 | 2022-06-03 |
| PoC in GitHub | Brucetg/CVE-2022-26134 | 2022-06-04 |
| PoC in GitHub | SNCKER/CVE-2022-26134 | 2022-06-04 |
| PoC in GitHub | kyxiaxiang/CVE-2022-26134 | 2022-06-04 |
| PoC in GitHub | shamo0/CVE-2022-26134 | 2022-06-04 |
Show 18 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 0xAgun/CVE-2022-26134 | 2022-06-05 |
| PoC in GitHub | Vulnmachines/Confluence-CVE-2022-26134 | 2022-06-05 |
| PoC in GitHub | abhishekmorla/CVE-2022-26134 | 2022-06-05 |
| PoC in GitHub | axingde/CVE-2022-26134 | 2022-06-05 |
| PoC in GitHub | SIFalcon/confluencePot | 2022-06-06 |
| PoC in GitHub | archanchoudhury/Confluence-CVE-2022-26134 | 2022-06-06 |
| PoC in GitHub | hev0x/CVE-2022-26134 | 2022-06-06 |
| PoC in GitHub | BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL | 2022-06-07 |
| PoC in GitHub | Habib0x0/CVE-2022-26134 | 2022-06-07 |
| PoC in GitHub | Y000o/Confluence-CVE-2022-26134 | 2022-06-07 |
| PoC in GitHub | alcaparra/CVE-2022-26134 | 2022-06-07 |
| PoC in GitHub | li8u99/CVE-2022-26134 | 2022-06-07 |
| PoC in GitHub | reubensammut/cve-2022-26134 | 2022-06-07 |
| PoC in GitHub | vesperp/CVE-2022-26134-Confluence | 2022-06-07 |
| PoC in GitHub | whokilleddb/CVE-2022-26134-Confluence-RCE | 2022-06-07 |
| PoC in GitHub | redhuntlabs/ConfluentPwn | 2022-06-08 |
| Exploit-DB | Confluence Data Center 7.18.0 - Remote Code Execution (RCE) | 2022-06-10 |
| Nuclei | Confluence - Remote Code Execution |
Plus 47 more. The full list has every link.
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| exploits, exploits_more | ||
| exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26134 is a critical vulnerability (CVSS 9.8) in Atlassian Confluence Server, published June 3, 2022. CISA lists it as known to be exploited, since June 2, 2022. EUVD reports exploitation since June 2, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.
References
jira.atlassian.com/browse/CONFSERVER-79016
packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134
nvd.nist.gov/vuln/detail/CVE-2022-26134
github.com/advisories/GHSA-653m-wpjp-54c4