{"id":"CVE-2022-26134","aliases":["EUVD-2022-30701","GHSA-653m-wpjp-54c4"],"status":"published","title":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists...","description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.99999,"percentile":0.99994,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-74","CWE-917"],"published":"2022-06-03T21:51:57Z","modified":"2026-06-17T04:34:44Z","kev":{"date_added":"2022-06-02","due_date":"2022-06-06","required_action":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-06-02"},{"source":"kev","since":"2022-06-02"}],"exploits":[{"source":"pocgithub","id":"W01fh4cker/Serein","title":"W01fh4cker/Serein","date":"2022-05-31","url":"https://github.com/W01fh4cker/Serein"},{"source":"metasploit","id":"exploit/multi/http/atlassian_confluence_namespace_ognl_injection","title":"Atlassian Confluence Namespace OGNL Injection","type":"exploit","platform":"Linux,Unix,Windows","date":"2022-06-02","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/atlassian_confluence_namespace_ognl_injection"},{"source":"pocgithub","id":"crowsec-edtech/CVE-2022-26134","title":"crowsec-edtech/CVE-2022-26134","date":"2022-06-03","url":"https://github.com/crowsec-edtech/CVE-2022-26134"},{"source":"pocgithub","id":"jbaines-r7/through_the_wire","title":"jbaines-r7/through_the_wire","date":"2022-06-03","url":"https://github.com/jbaines-r7/through_the_wire"},{"source":"pocgithub","id":"ma1am/CVE-2022-26134-Exploit-Detection","title":"ma1am/CVE-2022-26134-Exploit-Detection","date":"2022-06-03","url":"https://github.com/ma1am/CVE-2022-26134-Exploit-Detection"},{"source":"pocgithub","id":"offlinehoster/CVE-2022-26134","title":"offlinehoster/CVE-2022-26134","date":"2022-06-03","url":"https://github.com/offlinehoster/CVE-2022-26134"},{"source":"pocgithub","id":"Brucetg/CVE-2022-26134","title":"Brucetg/CVE-2022-26134","date":"2022-06-04","url":"https://github.com/Brucetg/CVE-2022-26134"},{"source":"pocgithub","id":"SNCKER/CVE-2022-26134","title":"SNCKER/CVE-2022-26134","date":"2022-06-04","url":"https://github.com/SNCKER/CVE-2022-26134"},{"source":"pocgithub","id":"kyxiaxiang/CVE-2022-26134","title":"kyxiaxiang/CVE-2022-26134","date":"2022-06-04","url":"https://github.com/kyxiaxiang/CVE-2022-26134"},{"source":"pocgithub","id":"shamo0/CVE-2022-26134","title":"shamo0/CVE-2022-26134","date":"2022-06-04","url":"https://github.com/shamo0/CVE-2022-26134"},{"source":"pocgithub","id":"0xAgun/CVE-2022-26134","title":"0xAgun/CVE-2022-26134","date":"2022-06-05","url":"https://github.com/0xAgun/CVE-2022-26134"},{"source":"pocgithub","id":"Vulnmachines/Confluence-CVE-2022-26134","title":"Vulnmachines/Confluence-CVE-2022-26134","date":"2022-06-05","url":"https://github.com/Vulnmachines/Confluence-CVE-2022-26134"},{"source":"pocgithub","id":"abhishekmorla/CVE-2022-26134","title":"abhishekmorla/CVE-2022-26134","date":"2022-06-05","url":"https://github.com/abhishekmorla/CVE-2022-26134"},{"source":"pocgithub","id":"axingde/CVE-2022-26134","title":"axingde/CVE-2022-26134","date":"2022-06-05","url":"https://github.com/axingde/CVE-2022-26134"},{"source":"pocgithub","id":"SIFalcon/confluencePot","title":"SIFalcon/confluencePot","date":"2022-06-06","url":"https://github.com/SIFalcon/confluencePot"},{"source":"pocgithub","id":"archanchoudhury/Confluence-CVE-2022-26134","title":"archanchoudhury/Confluence-CVE-2022-26134","date":"2022-06-06","url":"https://github.com/archanchoudhury/Confluence-CVE-2022-26134"},{"source":"pocgithub","id":"hev0x/CVE-2022-26134","title":"hev0x/CVE-2022-26134","date":"2022-06-06","url":"https://github.com/hev0x/CVE-2022-26134"},{"source":"pocgithub","id":"BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL","title":"BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL","date":"2022-06-07","url":"https://github.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL"},{"source":"pocgithub","id":"Habib0x0/CVE-2022-26134","title":"Habib0x0/CVE-2022-26134","date":"2022-06-07","url":"https://github.com/Habib0x0/CVE-2022-26134"},{"source":"pocgithub","id":"Y000o/Confluence-CVE-2022-26134","title":"Y000o/Confluence-CVE-2022-26134","date":"2022-06-07","url":"https://github.com/Y000o/Confluence-CVE-2022-26134"},{"source":"pocgithub","id":"alcaparra/CVE-2022-26134","title":"alcaparra/CVE-2022-26134","date":"2022-06-07","url":"https://github.com/alcaparra/CVE-2022-26134"},{"source":"pocgithub","id":"li8u99/CVE-2022-26134","title":"li8u99/CVE-2022-26134","date":"2022-06-07","url":"https://github.com/li8u99/CVE-2022-26134"},{"source":"pocgithub","id":"reubensammut/cve-2022-26134","title":"reubensammut/cve-2022-26134","date":"2022-06-07","url":"https://github.com/reubensammut/cve-2022-26134"},{"source":"pocgithub","id":"vesperp/CVE-2022-26134-Confluence","title":"vesperp/CVE-2022-26134-Confluence","date":"2022-06-07","url":"https://github.com/vesperp/CVE-2022-26134-Confluence"},{"source":"pocgithub","id":"whokilleddb/CVE-2022-26134-Confluence-RCE","title":"whokilleddb/CVE-2022-26134-Confluence-RCE","date":"2022-06-07","url":"https://github.com/whokilleddb/CVE-2022-26134-Confluence-RCE"},{"source":"pocgithub","id":"redhuntlabs/ConfluentPwn","title":"redhuntlabs/ConfluentPwn","date":"2022-06-08","url":"https://github.com/redhuntlabs/ConfluentPwn"},{"source":"exploitdb","id":"EDB-50952","title":"Confluence Data Center 7.18.0 - Remote Code Execution (RCE)","type":"webapps","platform":"java","date":"2022-06-10","url":"https://www.exploit-db.com/exploits/50952"},{"source":"nuclei","id":"CVE-2022-26134","title":"Confluence - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26134.yaml"}],"exploits_more":47,"products":[{"vendor":"atlassian","product":"confluence data center"},{"vendor":"atlassian","product":"confluence server"},{"vendor":"atlassian","product":"confluence server/data center"},{"vendor":"atlassian","product":"confluence_data_center"},{"vendor":"atlassian","product":"confluence_server"}],"references":[{"url":"https://jira.atlassian.com/browse/CONFSERVER-79016","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26134"},{"url":"https://github.com/advisories/GHSA-653m-wpjp-54c4"}],"sources":{"cve":[{"id":"CVE-2022-26134","description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","status":"published","published":"2022-06-03T21:51:57.134Z","modified":"2025-10-21T23:15:38.769Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-30701","description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","status":"published","published":"2022-06-03T21:51:57Z","modified":"2025-10-21T23:15:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-06-02","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-653m-wpjp-54c4","title":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists...","description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","status":"published","published":"2022-06-04T00:00:25Z","modified":"2025-10-22T00:33:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74","CWE-917"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-26134","title":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","description":"Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.","cwes":["CWE-917"],"kev":{"date_added":"2022-06-02","due_date":"2022-06-06","required_action":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2022-26134","description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","status":"published","published":"2022-06-03T22:15:07.717Z","modified":"2026-06-17T04:34:44.94Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T14:07:21.62951Z"}]}}