CVE-2022-26134

This vulnerability is like a “back door” in the Confluence software where an attacker can trick the server into running attacker-chosen code without needing a login. Imagine leaving a toolroom door unlocked and giving instructions that cause the tools to be used in a destructive way automatically. Because it’s been used in real ransomware activity, it’s not something to wait on.

This matters if your business runs Confluence Server, Confluence Data Center, or Jira Data Center on versions that are within the affected ranges (before the listed fixed versions). The key risk is that an attacker doesn’t need an account; they can trigger the problem from the network with crafted requests. This is especially dangerous if the Confluence/Jira app is reachable from the internet (directly or via an exposed reverse proxy), since that’s the access path attackers use.

This is RED because attackers are already known to exploit it in the real world (CISA KEV lists it as used in ransomware campaigns). The vulnerability enables unauthenticated arbitrary code execution, so exposure can turn into full takeover quickly when the service is reachable.

1. Confirm exposure and versions

   • Determine the exact Confluence Server/Data Center (and Jira Data Center, if applicable) version(s) and deployment type.
   • Treat any instance running before the fixed versions as exposed.

2. Map your version to the required fixed version

   • Confluence Server: upgrade to 7.4.17 if you are earlier than 7.4.17.
   • Confluence Data Center:
     • < 7.4.17 → upgrade to 7.4.17
     • 7.13.0–7.13.6 → upgrade to 7.13.7
     • 7.14.0–7.14.2 → upgrade to 7.14.3
     • 7.15.0–7.15.1 → upgrade to 7.15.2
     • 7.16.0–7.16.3 → upgrade to 7.16.4
     • 7.17.0–7.17.3 → upgrade to 7.17.4
     • 7.18.0 → upgrade to 7.18.1
   • If your exact version doesn’t match the above ranges, follow Atlassian’s Confluence security advisory referenced in the findings to select the correct patched branch.

3. Immediate containment (if internet-reachable and not patched yet)

   • Follow CISA’s KEV guidance: block all internet traffic to and from the affected products (or remove them from public access) until the update is successfully deployed.

4. Patch/upgrade

   • Perform the upgrade to the fixed version identified above.
   • Validate that the service is running correctly after upgrade.

5. Temporary/workaround note

   • The findings indicate the vendor did not provide compensating measures that fully neutralize the risk; therefore, treat network blocking/removal from public access as temporary containment until patching is complete.

6. Monitor after changes

   • Watch for suspicious traffic patterns, failed exploitation attempts, and unusual server behavior around the time of exposure and upgrade.

7. KEV timing

   • CISA’s remediation due date for this KEV entry was 2022-06-06. If you have not already upgraded, treat this as overdue and prioritize immediately.

CVE-2022-26134 is a OGNL injection (CWE-917) in affected versions of Confluence Server and Confluence Data Center that allows an unauthenticated attacker to achieve arbitrary code execution. The issue is listed in CISA’s KEV and used in ransomware campaigns, which elevates it from “theoretical” to actively exploited. Public proof-of-concept code exists (weaponized), and press/incident reporting has been sustained. The attack vector is typically network-based request crafting against the vulnerable application endpoints; no credentials are required, so real-world exposure depends primarily on whether the instance is reachable by an attacker (e.g., exposed to the internet). The fixed versions called out in the findings include 7.4.17 and multiple later branch-specific releases (7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1).