Atlassian Questions for Confluence Hardcoded Credentials Vulnerability (CVE-2022-26138) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTConfluence Server and Data Center environments with Questions for Confluence app versions 2.7.34, 2.7.35, and 3.0.2 installed
A remote, unauthenticated attacker can exploit the hardcoded 'disabledsystemuser' account to log into Confluence and access all sensitive content
Immediately upgrade the Questions for Confluence app to a non-vulnerable version or disable/delete the 'disabledsystemuser' account
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to upgrade the Questions for Confluence app to a fixed version (2.7.38, 3.0.5, or higher). You can verify the installed app version via the Confluence REST API before upgrading.
# Check the installed version of the Questions for Confluence app via API
curl -u 'admin_user:admin_password' -X GET 'http://localhost:8090/rest/plugins/1.0/com.atlassian.confluence.plugins.confluence-questions-key' | grep -i 'version'2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, administrators must manually disable or delete the 'disabledsystemuser' account from the Confluence User Management console. Additionally, restrict external access to the Confluence login and API endpoints using a reverse proxy.
# Nginx configuration to restrict external access to Confluence API endpoints
server {
listen 80;
server_name confluence.local;
location /rest/api/ {
allow 10.0.0.0/8;
deny all;
proxy_pass http://127.0.0.1:8090;
}
}3. Log Audit & IoC Verification Commands
Query the Confluence database directly to check if the vulnerable account exists and is active, and inspect the access logs for any unauthorized login attempts using this account.
# Query PostgreSQL database to check the status of the hardcoded account
psql -U confluence_db_user -d confluence -c "SELECT username, active FROM cwd_user WHERE username = 'disabledsystemuser';"
# Search Confluence access logs for authentication attempts by the hardcoded user
grep -i 'disabledsystemuser' /var/atlassian/application-data/confluence/logs/atlassian-confluence-access.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-26138) is a critical hardcoded credentials issue (CWE-798) within the 'Questions for Confluence' application for Confluence Server and Data Center. When installing or upgrading to specific affected versions of the app, a system user account with the username 'disabledsystemuser' and a static, hardcoded password is automatically created and added to the 'confluence-users' group.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker who identifies an internet-facing Confluence instance running the vulnerable app can use the publicly known hardcoded password to authenticate as 'disabledsystemuser'. Because this account is a member of the default 'confluence-users' group, the attacker gains immediate access to all spaces, pages, attachments, and user directories that are visible to standard registered users, without requiring any privilege escalation.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an active and severe threat. Confluence instances often store highly sensitive corporate knowledge, proprietary source code designs, and internal credentials. Unauthorized access can lead to massive data exfiltration and intellectual property theft.
Official Vendor Advisories & References
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Frequently Asked SecOps Questions (CVE-2022-26138)
FAQQ1. How critical is CVE-2022-26138 and is it actively exploited in the wild?
CVE-2022-26138 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 98.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-26138?
Primary impacted vendors include atlassian across questions for confluence, confluence server, confluence data center. Scope summary: Confluence Server and Data Center instances with Questions for Confluence app versions 2.7.34, 2.7.35, and 3.0.2 active
Q3. What temporary mitigations or workarounds exist for CVE-2022-26138 before patching?
[Mitigation] Immediately upgrade the Questions for Confluence app to a non-vulnerable version or disable/delete the 'disabledsystemuser' account Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-26138
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (atlassian)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
Dell RecoverPoint for Virtual Machines Hardcoded Credentials Vulnerability (CVE-2026-22769) Security Advisory
[Affected Scope] Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.