CVE-2022-26134: Atlassian Confluence OGNL Injection RCE
Summary
Atlassian Confluence Server and Data Center allow unauthenticated remote code execution via OGNL injection in the HTTP server.
Why It Matters
CRITICAL severity — known to be exploited in the wild（CISA KEV）；action required: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules. ；affects Atlassian Confluence Server/Data Center 7.4.0 to 7.4.16, Confluence 7.13.0 to 7.13.6, Confluence 7.14.0 to 7.14.2 and more.
Current Status
- Vulnerability status: Known exploited (CISA KEV)
- Last intelligence update: 2026-10-27 · source: NVD
- CISA KEV added: 2022-06-02 · remediation deadline: 2022-06-06
Entity Activity Timeline
- 2022-06-02 — Added to CISA KEV as known-exploited · action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
- 2022-06-02 — NVD publication / disclosure
- 2026-10-27 — Intelligence record updated（NVD sync）
Severity
CRITICAL
CVSS Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited (CISA KEV)
Known Exploited Vulnerability
Added: 2022-06-02 · Remediation deadline: 2022-06-06
Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Source Attribution
Source: NVD · Updated: 2026-10-27T00:00:00.000 · Confidence: high
Impact
Based on CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — assess confidentiality, integrity, and availability impact via the official vector documentation.
Affected Software
- Atlassian Confluence Server/Data Center 7.4.0 to 7.4.16 (Unknown)
- Confluence 7.13.0 to 7.13.6 (Unknown)
- Confluence 7.14.0 to 7.14.2 (Unknown)
- Confluence 7.15.0 (Unknown)
- Confluence 7.16.0 (Unknown)
- Confluence 7.17.0 to 7.17.2 (Unknown)
Fix
Upgrade affected software to the fixed version identified above. Apply vendor patches and monitor advisories before exposed systems go unpatched.
Sources & Evidence
Export threat intelligence
Download an OASIS STIX 2.1 threat-intelligence bundle (JSON) for MISP / OpenCTI / TAXII import
Start Investigation
Move from reading to investigating CVE-2022-26134: Atlassian Confluence OGNL Injection RCE. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about CVE-2022-26134: Atlassian Confluence OGNL Injection RCE?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.
Recommended Tools
- CVE Lookup Open the full CVE record — severity, CVSS, affected products, CISA KEV and references. Open CVE record
Every tool runs passively or locally — inputs are never stored and no target is scanned. Start an investigation on this entity →