{"history":[{"alert":0,"cve":"CVE-2022-26134","id":22385,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":0,"cve":"CVE-2022-26134","id":20004,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":0,"cve":"CVE-2022-26134","id":17970,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":0,"cve":"CVE-2022-26134","id":16034,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":0,"cve":"CVE-2022-26134","id":14012,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":0,"cve":"CVE-2022-26134","id":11794,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":0,"cve":"CVE-2022-26134","id":9780,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":1,"cve":"CVE-2022-26134","id":8304,"kind":"cna","observed_at":1793852400,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-03T04:56:37.787Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://jira.atlassian.com/browse/CONFSERVER-79016\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2022-26134\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-02-04T14:18:48.606174Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2022-06-02\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-917\", \"description\": \"CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:15:38.769Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-06-02T00:00:00.000Z\", \"value\": \"CVE-2022-26134 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"Confluence Data Center\", \"vendor\": \"Atlassian\", \"versions\": [{\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"next of 1.3.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.4.17\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.13.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.13.7\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.14.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.14.3\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.15.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.15.2\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.16.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.16.4\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.17.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.17.4\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.18.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.18.1\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"product\": \"Confluence Server\", \"vendor\": \"Atlassian\", \"versions\": [{\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"next of 1.3.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.4.17\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.13.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.13.7\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.14.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.14.3\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.15.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.15.2\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.16.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.16.4\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.17.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.17.4\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}, {\"lessThan\": \"unspecified\", \"status\": \"affected\", \"version\": \"7.18.0\", \"versionType\": \"custom\"}, {\"lessThan\": \"7.18.1\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}], \"datePublic\": \"2022-05-31T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Remote Code Execution\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2022-06-30T05:20:13.000Z\", \"orgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"shortName\": \"atlassian\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://jira.atlassian.com/browse/CONFSERVER-79016\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security@atlassian.com\", \"DATE_PUBLIC\": \"2022-05-31T20:00:00\", \"ID\": \"CVE-2022-26134\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Confluence Data Center\", \"version\": {\"version_data\": [{\"version_affected\": \">\", \"version_value\": \"1.3.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.4.17\"}, {\"version_affected\": \">=\", \"version_value\": \"7.13.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.13.7\"}, {\"version_affected\": \">=\", \"version_value\": \"7.14.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.14.3\"}, {\"version_affected\": \">=\", \"version_value\": \"7.15.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.15.2\"}, {\"version_affected\": \">=\", \"version_value\": \"7.16.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.16.4\"}, {\"version_affected\": \">=\", \"version_value\": \"7.17.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.17.4\"}, {\"version_affected\": \">=\", \"version_value\": \"7.18.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.18.1\"}]}}, {\"product_name\": \"Confluence Server\", \"version\": {\"version_data\": [{\"version_affected\": \">\", \"version_value\": \"1.3.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.4.17\"}, {\"version_affected\": \">=\", \"version_value\": \"7.13.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.13.7\"}, {\"version_affected\": \">=\", \"version_value\": \"7.14.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.14.3\"}, {\"version_affected\": \">=\", \"version_value\": \"7.15.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.15.2\"}, {\"version_affected\": \">=\", \"version_value\": \"7.16.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.16.4\"}, {\"version_affected\": \">=\", \"version_value\": \"7.17.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.17.4\"}, {\"version_affected\": \">=\", \"version_value\": \"7.18.0\"}, {\"version_affected\": \"<\", \"version_value\": \"7.18.1\"}]}}]}, \"vendor_name\": \"Atlassian\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Remote Code Execution\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://jira.atlassian.com/browse/CONFSERVER-79016\", \"refsource\": \"MISC\", \"url\": \"https://jira.atlassian.com/browse/CONFSERVER-79016\"}, {\"name\": \"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html\"}, {\"name\": \"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html\"}, {\"name\": \"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html\"}, {\"name\": \"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html\"}, {\"name\": \"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html\", \"refsource\": \"MISC\", \"url\": \"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"assignerShortName\": \"atlassian\", \"cveId\": \"CVE-2022-26134\", \"datePublished\": \"2022-06-03T21:51:57.134Z\", \"dateReserved\": \"2022-02-25T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:15:38.769Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2022-26134","id":7328,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.99999, \"percentile\": 0.99994}"},{"alert":0,"cve":"CVE-2022-26134","id":5105,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.99999, \"percentile\": 0.99993}"},{"alert":0,"cve":"CVE-2022-26134","id":2887,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.99999, \"percentile\": 0.99993}"},{"alert":1,"cve":"CVE-2022-26134","id":1029,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2022-26134\", \"cwes\": [\"CWE-917\"], \"dateAdded\": \"2022-06-02\", \"dueDate\": \"2022-06-06\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-26134\", \"product\": \"Confluence Server/Data Center\", \"requiredAction\": \"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.\", \"shortDescription\": \"Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.\", \"vendorProject\": \"Atlassian\", \"vulnerabilityName\": \"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability\"}"}],"record":{"affected":[{"product":"Confluence Data Center","vendor":"Atlassian","versions":[{"lessThan":"unspecified","status":"affected","version":"next of 1.3.0","versionType":"custom"},{"lessThan":"7.4.17","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.13.0","versionType":"custom"},{"lessThan":"7.13.7","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.14.0","versionType":"custom"},{"lessThan":"7.14.3","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.15.0","versionType":"custom"},{"lessThan":"7.15.2","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.16.0","versionType":"custom"},{"lessThan":"7.16.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.17.0","versionType":"custom"},{"lessThan":"7.17.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.18.0","versionType":"custom"},{"lessThan":"7.18.1","status":"affected","version":"unspecified","versionType":"custom"}]},{"product":"Confluence Server","vendor":"Atlassian","versions":[{"lessThan":"unspecified","status":"affected","version":"next of 1.3.0","versionType":"custom"},{"lessThan":"7.4.17","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.13.0","versionType":"custom"},{"lessThan":"7.13.7","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.14.0","versionType":"custom"},{"lessThan":"7.14.3","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.15.0","versionType":"custom"},{"lessThan":"7.15.2","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.16.0","versionType":"custom"},{"lessThan":"7.16.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.17.0","versionType":"custom"},{"lessThan":"7.17.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.18.0","versionType":"custom"},{"lessThan":"7.18.1","status":"affected","version":"unspecified","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-03T04:56:37.787Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://jira.atlassian.com/browse/CONFSERVER-79016"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2022-26134","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-04T14:18:48.606174Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-06-02","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-917","description":"CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:15:38.769Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134"}],"timeline":[{"lang":"en","time":"2022-06-02T00:00:00.000Z","value":"CVE-2022-26134 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Confluence Data Center","vendor":"Atlassian","versions":[{"lessThan":"unspecified","status":"affected","version":"next of 1.3.0","versionType":"custom"},{"lessThan":"7.4.17","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.13.0","versionType":"custom"},{"lessThan":"7.13.7","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.14.0","versionType":"custom"},{"lessThan":"7.14.3","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.15.0","versionType":"custom"},{"lessThan":"7.15.2","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.16.0","versionType":"custom"},{"lessThan":"7.16.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.17.0","versionType":"custom"},{"lessThan":"7.17.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.18.0","versionType":"custom"},{"lessThan":"7.18.1","status":"affected","version":"unspecified","versionType":"custom"}]},{"product":"Confluence Server","vendor":"Atlassian","versions":[{"lessThan":"unspecified","status":"affected","version":"next of 1.3.0","versionType":"custom"},{"lessThan":"7.4.17","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.13.0","versionType":"custom"},{"lessThan":"7.13.7","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.14.0","versionType":"custom"},{"lessThan":"7.14.3","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.15.0","versionType":"custom"},{"lessThan":"7.15.2","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.16.0","versionType":"custom"},{"lessThan":"7.16.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.17.0","versionType":"custom"},{"lessThan":"7.17.4","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"7.18.0","versionType":"custom"},{"lessThan":"7.18.1","status":"affected","version":"unspecified","versionType":"custom"}]}],"datePublic":"2022-05-31T00:00:00.000Z","descriptions":[{"lang":"en","value":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1."}],"problemTypes":[{"descriptions":[{"description":"Remote Code Execution","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2022-06-30T05:20:13.000Z","orgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","shortName":"atlassian"},"references":[{"tags":["x_refsource_MISC"],"url":"https://jira.atlassian.com/browse/CONFSERVER-79016"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html"},{"tags":["x_refsource_MISC"],"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2022-05-31T20:00:00","ID":"CVE-2022-26134","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Confluence Data Center","version":{"version_data":[{"version_affected":">","version_value":"1.3.0"},{"version_affected":"<","version_value":"7.4.17"},{"version_affected":">=","version_value":"7.13.0"},{"version_affected":"<","version_value":"7.13.7"},{"version_affected":">=","version_value":"7.14.0"},{"version_affected":"<","version_value":"7.14.3"},{"version_affected":">=","version_value":"7.15.0"},{"version_affected":"<","version_value":"7.15.2"},{"version_affected":">=","version_value":"7.16.0"},{"version_affected":"<","version_value":"7.16.4"},{"version_affected":">=","version_value":"7.17.0"},{"version_affected":"<","version_value":"7.17.4"},{"version_affected":">=","version_value":"7.18.0"},{"version_affected":"<","version_value":"7.18.1"}]}},{"product_name":"Confluence Server","version":{"version_data":[{"version_affected":">","version_value":"1.3.0"},{"version_affected":"<","version_value":"7.4.17"},{"version_affected":">=","version_value":"7.13.0"},{"version_affected":"<","version_value":"7.13.7"},{"version_affected":">=","version_value":"7.14.0"},{"version_affected":"<","version_value":"7.14.3"},{"version_affected":">=","version_value":"7.15.0"},{"version_affected":"<","version_value":"7.15.2"},{"version_affected":">=","version_value":"7.16.0"},{"version_affected":"<","version_value":"7.16.4"},{"version_affected":">=","version_value":"7.17.0"},{"version_affected":"<","version_value":"7.17.4"},{"version_affected":">=","version_value":"7.18.0"},{"version_affected":"<","version_value":"7.18.1"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Remote Code Execution"}]}]},"references":{"reference_data":[{"name":"https://jira.atlassian.com/browse/CONFSERVER-79016","refsource":"MISC","url":"https://jira.atlassian.com/browse/CONFSERVER-79016"},{"name":"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html"},{"name":"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html"},{"name":"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html"},{"name":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html"},{"name":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html","refsource":"MISC","url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html"}]}}}},"cveMetadata":{"assignerOrgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","assignerShortName":"atlassian","cveId":"CVE-2022-26134","datePublished":"2022-06-03T21:51:57.134Z","dateReserved":"2022-02-25T00:00:00.000Z","dateUpdated":"2025-10-21T23:15:38.769Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794327601,"cve":"CVE-2022-26134","description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","epss":{"date":"2026-11-12","epss":0.99999,"percentile":0.99994},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2022-26134","cwes":["CWE-917"],"dateAdded":"2022-06-02","dueDate":"2022-06-06","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26134","product":"Confluence Server/Data Center","requiredAction":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","shortDescription":"Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.","vendorProject":"Atlassian","vulnerabilityName":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability"},"kev_checked":1794522003,"products":"Atlassian Confluence Data Center, Atlassian Confluence Server","references":["https://jira.atlassian.com/browse/CONFSERVER-79016","http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html","http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html","http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html","https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}