Atlassian Confluence Data Center and Server Privilege Escalation and RCE Vulnerability (CVE-2023-22515) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTOn-premise deployments of Atlassian Confluence Data Center and Confluence Server (Atlassian Cloud instances are not affected)
Unauthenticated remote attackers can bypass access controls to access setup endpoints, create unauthorized administrator accounts, and achieve full system compromise
Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Confluence to the latest patched LTS release. Below is an example of how to stop the service and perform an upgrade on a Linux server.
# 1. Stop the Confluence service
sudo systemctl stop confluence
# 2. Backup the Confluence Home directory and database
tar -czvf confluence_home_backup.tar.gz /var/atlassian/application-data/confluence
# 3. Download and run the latest patched installer (e.g., 8.5.3 LTS)
wget https://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-8.5.3-x64.bin
chmod +x atlassian-confluence-8.5.3-x64.bin
sudo ./atlassian-confluence-8.5.3-x64.bin2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block all external access to the /setup/* endpoints using a reverse proxy such as Nginx.
# Add this block to your Nginx configuration to block setup endpoints
server {
listen 80;
server_name confluence.internal.local;
# Block access to vulnerable setup endpoints (CVE-2023-22515)
location ~* ^/setup/ {
deny all;
return 403;
}
location / {
proxy_pass http://127.0.0.1:8090;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}3. Log Audit & IoC Verification Commands
Use the following commands to inspect Confluence access logs for unauthorized access to setup endpoints and verify newly created admin accounts.
# 1. Scan access logs for suspicious requests to setup actions
echo '=== [Audit] Scanning for unauthorized /setup/ access ==='
grep -E '/setup/.*\.action' /opt/atlassian/confluence/logs/conf_access_log.*.log
# 2. Check for recently created active users in the database (PostgreSQL example)
echo '=== [Audit] Checking recently created Confluence users ==='
# psql -U confluence_user -d confluence_db -c "SELECT username, created_date FROM cwd_user WHERE active = 'Y' ORDER BY created_date DESC LIMIT 10;"Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-22515) is a critical broken access control flaw (CWE-20) in Atlassian Confluence Data Center and Server. The root cause lies in the improper validation of HTTP request parameters within the XWork/Struts2-based web framework. This allows unauthenticated remote attackers to manipulate internal state variables and access setup-related actions (/setup/*) even after the initial installation has been completed.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a crafted HTTP POST request targeting endpoints such as /setup/setup-restore.action or /setup/bootstrapStatus.action. By manipulating the request parameters, the attacker forces the application to reset its installation state or bypass authorization checks. This enables the attacker to register a new administrative account without any prior credentials. Once administrative access is established, the attacker can upload malicious plugins or web shells to execute arbitrary OS commands, leading to Remote Code Execution (RCE).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and active exploitation in the wild (listed in CISA KEV and high EPSS score), this vulnerability poses an extreme risk. Successful exploitation allows complete takeover of the Confluence instance, leading to the theft of proprietary data, intellectual property, and credentials stored within the wiki. Furthermore, compromised servers can be used as a pivot point to move laterally within the internal network or deploy ransomware.
Official Vendor Advisories & References
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Frequently Asked SecOps Questions (CVE-2023-22515)
FAQQ1. How critical is CVE-2023-22515 and is it actively exploited in the wild?
CVE-2023-22515 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-22515?
Primary impacted vendors include atlassian across confluence data center, confluence server. Scope summary: Atlassian Confluence Data Center and Server versions 8.0.0 through 8.5.1 (excluding patched versions 8.3.3, 8.4.3, 8.5.2, and above)
Q3. What temporary mitigations or workarounds exist for CVE-2023-22515 before patching?
[Mitigation] Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-22515
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (atlassian)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
PTC Windchill and FlexPLM Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-12569)
[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Microsoft SharePoint Spoofing Vulnerability due to Improper Input Validation (CVE-2026-32201)
[Affected Scope] Microsoft SharePoint Server deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.