Atlassian Confluence Server and Data Center OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2022-26134) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAtlassian Confluence Server and Data Center versions from 1.3.0 before 7.4.17, and specific release lines up to 7.18.1
An unauthenticated remote attacker can execute arbitrary Java code on the Confluence instance with system privileges, leading to full host compromise.
Immediately upgrade Confluence to the patched versions (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or higher) or apply the vendor-provided workaround JAR files.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Confluence to a patched release. Below are the commands to stop the service and perform an upgrade on a Linux-based server.
# 1. Stop the running Confluence service
sudo systemctl stop confluence
# 2. Download the patched LTS installer (e.g., version 7.13.7)
wget https://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-7.13.7-x64.bin
# 3. Grant execution permissions and run the installer
chmod +x atlassian-confluence-7.13.7-x64.bin
sudo ./atlassian-confluence-7.13.7-x64.bin2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, deploy Web Application Firewall (WAF) rules or configure a reverse proxy like Nginx to block requests containing OGNL syntax characters.
# Add this block inside your Nginx server configuration to block OGNL injection attempts
server {
listen 80;
server_name confluence.company.com;
# Block requests containing OGNL special characters or encoding patterns
if ($request_uri ~* '(\%24|\$|\%25|\%40|\@)') {
return 403 'Access Denied: Potential Exploit Attempt Blocked';
}
location / {
proxy_pass http://127.0.0.1:8090;
proxy_set_header Host $host;
}
}3. Log Audit & IoC Verification Commands
Scan Confluence access logs to identify potential exploitation attempts containing OGNL payloads or suspicious Java class invocations.
# Navigate to the Confluence access log directory
cd /var/atlassian/application-data/confluence/logs
# Search for common OGNL injection keywords and patterns in the access logs
grep -Ei 'runtime|processbuilder|ognl|memberaccess|classloader' conf_access_log.*.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-26134) is a critical Object-Graph Navigation Language (OGNL) injection vulnerability in Atlassian Confluence Server and Data Center. The root cause lies in the web framework's improper validation and sanitization of user-supplied input within HTTP request URIs or headers before evaluating them as OGNL expressions. This allows unauthenticated attackers to execute arbitrary code within the context of the Confluence Java Virtual Machine (JVM).
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious HTTP request where the URI path (namespace) or specific headers contain a payload structured as an OGNL expression. When Confluence processes the request, the WebWork/Struts2 framework parses the namespace and evaluates the embedded OGNL expression. By instantiating Java classes such as 'java.lang.Runtime' or 'java.lang.ProcessBuilder' within the expression, the attacker bypasses authentication and forces the server to execute arbitrary operating system commands under the privileges of the 'confluence' service user.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and active exploitation in the wild (listed in CISA KEV), this vulnerability poses an extreme risk. Successful exploitation allows complete takeover of the Confluence server, enabling attackers to exfiltrate sensitive intellectual property, access database credentials, deploy web shells for persistent access, and pivot laterally into the internal corporate network to deploy ransomware or compromise active directory domains.
Official Vendor Advisories & References
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Frequently Asked SecOps Questions (CVE-2022-26134)
FAQQ1. How critical is CVE-2022-26134 and is it actively exploited in the wild?
CVE-2022-26134 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-26134?
Primary impacted vendors include atlassian across confluence_server, confluence_data_center. Scope summary: Atlassian Confluence Server and Data Center: 1.3.0 before 7.4.17, 7.13.0 before 7.13.7, 7.14.0 before 7.14.3, 7.15.0 before 7.15.2, 7.16.0 before 7.16.4, 7.17.0 before 7.17.4, and 7.18.0 before 7.18.1
Q3. What temporary mitigations or workarounds exist for CVE-2022-26134 before patching?
[Mitigation] Immediately upgrade Confluence to the patched versions (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or higher) or apply the vendor-provided workaround JAR files. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-26134
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (atlassian)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.