CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

CVE-2022-26134 is a remote code execution vulnerability in Atlassian Confluence Server and Data Center. An unauthenticated attacker can exploit it to run code on the affected system. It matters because Confluence often holds internal documentation and collaboration data, is frequently reachable from the network, and this issue has been used in ransomware activity. Teams should treat internet-facing instances as high priority and confirm all version and fix details against the vendor advisory.

How it works

The weakness is classified as CWE-917 (Expression Language Injection). In products that evaluate expression language in user-controlled input, an attacker who can supply crafted expressions may cause the application to evaluate them in an unsafe way. For this Confluence vulnerability, CISA describes an unauthenticated remote code execution path: an attacker who can reach the vulnerable service does not need valid credentials to trigger code execution on the host.

Exact request paths, payloads, and preconditions are not repeated here; defenders should obtain those only from the official Atlassian security advisory and validated detection content. The practical impact is full compromise of the Confluence process and, depending on privileges and host configuration, further movement into the surrounding environment.

Am I affected? How to find it in your systems

Confluence Server and Data Center typically run as on-premises or self-managed Java web applications behind a reverse proxy or load balancer, often on internal wikis, intranet portals, or project spaces. Cloud-hosted Atlassian Confluence is a different deployment model; focus inventory on self-managed Server and Data Center instances.

• Inventory: query CMDB, software asset tools, container/orchestrator inventories, and reverse-proxy or WAF configs for hosts serving Confluence. Check listening services and TLS certificates that identify Confluence.
• Version and configuration: record the installed Confluence version and build against the fixed versions listed in the vendor advisory. Do not assume a build is safe without that check.
• Exposure: determine whether the instance accepts connections from the internet or untrusted networks. CISA specifically calls out blocking internet traffic to and from affected products.
• Telemetry: review web access logs, reverse-proxy logs, and WAF logs for anomalous unauthenticated requests to Confluence endpoints around the time of public exploitation. Host EDR may show unexpected child processes from the Confluence/Java service account. Treat hits as investigation leads and validate with vendor or trusted scanner signatures rather than relying on generic patterns alone.

How to remediate

Patch first. Apply the update published in Atlassian’s security advisory for CVE-2022-26134 (the advisory referenced in CISA’s required action). Follow vendor install and restart procedures, then verify the running version matches a fixed release.

• After patching, reassess any temporary internet-blocking rules as CISA notes once the update is successfully deployed.
• Harden the service: run Confluence with least privilege, keep the OS and Java runtime current per vendor guidance, restrict management interfaces, and ensure the instance is not unnecessarily exposed beyond authenticated users who need it.
• Remove or decommission end-of-life or unneeded Confluence Server/Data Center instances rather than leaving them reachable.

If you can't patch immediately

Use compensating controls until the vendor update is applied.

• Network: immediately block all internet traffic to and from affected products, per CISA. Segment Confluence onto a restricted VLAN or security group; allow only necessary internal clients.
• Edge filtering: if a WAF or reverse proxy sits in front, apply vendor- or community-validated virtual patch rules for this CVE only after testing; virtual patching is not a substitute for the official update.
• Feature and access reduction: disable public or anonymous access if your deployment allows it; require VPN or zero-trust access for all users.
• Monitoring: heighten alerting on the Confluence host for unusual process execution, outbound connections, web shells, and authentication anomalies. Preserve logs for incident response.
• If patching remains impossible by required timelines, plan removal of the affected product as CISA describes.

If your data may have been exposed

This vulnerability enables unauthenticated remote code execution and has known ransomware use. If your Confluence instance was reachable and unpatched during the exploitation window, assume possible host compromise, credential theft, and access to content stored in Confluence. Isolate affected systems, rotate secrets and service account credentials, review outbound data transfers, and follow your incident response process. You can run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in public breach corpora while you complete containment and recovery.