Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (CVE-2023-22518) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAll self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)
Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.
Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Atlassian recommends upgrading to the latest secure LTS releases immediately. Below is an example of how to stop the Confluence service and perform an upgrade on a Linux server.
# Stop the Confluence service
sudo systemctl stop confluence
# Download the secure version installer (e.g., 8.5.3 LTS)
wget https://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-8.5.3-x64.bin
# Grant execution permissions and run the installer
chmod +x atlassian-confluence-8.5.3-x64.bin
sudo ./atlassian-confluence-8.5.3-x64.bin2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, block external access to the /setup endpoints using a reverse proxy (e.g., Nginx) or a Web Application Firewall (WAF).
# Nginx configuration block (/etc/nginx/conf.d/confluence.conf)
server {
listen 80;
server_name confluence.local;
# Block external access to the vulnerable setup endpoints
location ~* ^/setup(/.*)?$ {
deny all;
return 403;
}
location / {
proxy_pass http://127.0.0.1:8090;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}3. Log Audit & IoC Verification Commands
Inspect Confluence access logs for unauthorized requests to the /setup path and verify if any unexpected administrator accounts have been created.
# Search access logs for requests targeting the setup endpoints
grep -i '/setup' /var/atlassian/application-data/confluence/logs/atlassian-confluence-access*.log
# Query the database to check for recently created active users (PostgreSQL example)
psql -U confluenceuser -d confdb -c "SELECT username, created_date FROM cwd_user WHERE active = 'T' ORDER BY created_date DESC LIMIT 5;"Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-22518) is an Improper Authorization flaw (CWE-863) in Atlassian Confluence Data Center and Server. The root cause lies in the lack of proper authorization checks on endpoints responsible for the initial setup and recovery processes. This allows unauthenticated attackers to send requests that reset the application's installation state.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a crafted HTTP request targeting setup-related endpoints (such as /setup/*) on the Confluence server. Because the application fails to validate the authorization state of the requester, it processes the request and reverts the system to an unconfigured setup state. The attacker can then complete the setup wizard to register a new administrator account, gaining full administrative control over the instance.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV list, this vulnerability poses an extreme risk to enterprise environments. Successful exploitation allows attackers to access, modify, or delete sensitive corporate knowledge bases, source codes, and credentials. It can also serve as an entry point for deploying malicious plugins or pivoting deeper into the internal network.
Official Vendor Advisories & References
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Frequently Asked SecOps Questions (CVE-2023-22518)
FAQQ1. How critical is CVE-2023-22518 and is it actively exploited in the wild?
CVE-2023-22518 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-22518?
Primary impacted vendors include atlassian across confluence data center, confluence server. Scope summary: All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites hosted on *.atlassian.net are not affected)
Q3. What temporary mitigations or workarounds exist for CVE-2023-22518 before patching?
[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-22518
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (atlassian)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
Adobe Commerce (Magento) Critical Privilege Escalation Vulnerability Advisory (CVE-2026-71362)
[Affected Scope] All versions of Adobe Commerce and Magento Open Source (2.4.7 and earlier)
IXP Manager IDOR Vulnerability in API Key Management (CVE-2026-63338)
[Affected Scope] All IXP Manager installations prior to version 7.3.0.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.