Every CVE Search/ Get API key

CVE-2023-22527

Summary of Vulnerability A template injection vulnerability on older versions of Confluence Data...

10.0 CriticalIn KEVPublic exploit

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 99.9 points since Jan 17, 2024
90%50%10%1%

What each source reports

CVE List Score used 10.0

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Record
CVE-2023-22527
CVSS 3.0
10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2023-26667 10.0

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Record
EUVD-2023-26667
CVSS 3.0
10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-w64x-j9r3-q79q 10.0

Summary of Vulnerability A template injection vulnerability on older versions of Confluence Data...

Summary of Vulnerability A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

See “What You Need to Do” for detailed instructions.

{panel:bgColor=#deebff} Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. {panel} Affected Versions ||Product||Affected Versions|| |Confluence Data Center and Server| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Fixed Versions ||Product||Fixed Versions|| |Confluence Data Center and Server|8.5.4 (LTS)| |Confluence Data Center| 8.6.0 or later (Data Center Only) 8.7.1 or later (Data Center Only)| What You Need To Do Immediately patch to a fixed version

Atlassian recommends that you patch each of your affected installations to the latest version. The listed Fixed Versions are no longer the most up-to-date versions and do not protect your instance from other non-critical vulnerabilities as outlined in Atlassian’s January Security Bulletin. ||Product||Fixed Versions||Latest Versions|| |Confluence Data Center and Server| 8.5.4 (LTS)| 8.5.5 (LTS) |Confluence Data Center| 8.6.0 or later (Data Center Only) 8.7.1 or later (Data Center Only)| 8.6.3 or later (Data Center Only) 8.7.2 or later (Data Center Only)

For additional details, please see full advisory.

Record
GHSA-w64x-j9r3-q79q
CVSS 3.0
10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
CISA KEV No score

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

Record
CVE-2023-22527
Weakness
CWE-74
Updated
2026-11-02
NVD 9.8

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Record
CVE-2023-22527
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubAvento/CVE-2023-22527_Confluence_RCE2024-01-16
PoC in GitHubSudistark/patch-diff-CVE-2023-225272024-01-16
MetasploitAtlassian Confluence SSTI Injection2024-01-16
PoC in GitHubga0we1/CVE-2023-22527_Confluence_RCE2024-01-17
PoC in GitHubDrun1baby/CVE-2023-225272024-01-22
PoC in GitHubthanhlam-attt/CVE-2023-225272024-01-22
PoC in GitHubC1ph3rX13/CVE-2023-225272024-01-23
PoC in GitHubChocapikk/CVE-2023-225272024-01-23
PoC in GitHubManh130902/CVE-2023-22527-POC2024-01-23
PoC in GitHubNiuwoo/CVE-2023-225272024-01-23
Show 15 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubRevoltSecurities/CVE-2023-225272024-01-23
PoC in GitHubVNCERT-CC/CVE-2023-22527-confluence2024-01-23
PoC in GitHubVozec/CVE-2023-225272024-01-23
PoC in GitHubPrivia-Security/CVE-2023-225272024-01-24
PoC in GitHubyoryio/CVE-2023-225272024-01-24
PoC in GitHubMaanVader/CVE-2023-22527-POC2024-01-25
PoC in GitHubYongYe-Security/CVE-2023-225272024-02-02
PoC in GitHubBoogipop/CVE-2023-22527-Godzilla-MEMSHELL2024-02-11
PoC in GitHubM0untainShley/CVE-2023-22527-MEMSHELL2024-02-26
PoC in GitHubvulncheck-oss/cve-2023-225272024-03-04
PoC in GitHubBBD-YZZ/Confluence-RCE2024-05-29
PoC in GitHubkh4sh3i/CVE-2023-225272024-10-06
PoC in GitHubthompson005/CVE-2023-225272025-05-29
PoC in GitHubmylo-2001/AtlassianPwn2025-11-21
NucleiAtlassian Confluence - Remote Code Execution

History

History
RecordedChangedSources
exploitation
exploits
exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-22527 is a critical vulnerability (CVSS 10.0) in Atlassian Confluence Data Center, published January 16, 2024. CISA lists it as known to be exploited, since January 24, 2024. EUVD reports exploitation since January 24, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open