CVE-2022-26134: Atlassian Confluence Server and Data Center OGNL injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with near-certain exploitation likelihood, active KEV listing, and documented ransomware use.

What it is

Confluence Server and Data Center contain an OGNL expression language injection flaw that lets an unauthenticated attacker execute arbitrary code on the instance. It affects a wide range of versions from 1.3.0 through the 7.18.x line, so most unpatched deployments are exposed. Because it is remotely reachable without credentials, it is a top-tier target for mass exploitation.

Impact

An attacker gains remote code execution on the Confluence host, which typically means full control of the application and its data, and potentially the underlying server. This can lead to data theft, ransomware deployment, or use of the host as a pivot into the network.

Attack surface

The vulnerability is network-reachable over HTTP/HTTPS with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed or internally reachable Confluence Server or Data Center instance in an affected version is a candidate.

Exploitation

CISA added it to KEV on 2022-06-02 with a 2022-06-06 remediation due date and flagged known ransomware campaign use; EPSS is near 1.0 (0.99999, 99.993rd percentile). Multiple public exploit and proof-of-concept references exist, so exploitation is trivial and widespread.

What to do

• Upgrade to a fixed Confluence release per the Atlassian advisory (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, or 7.18.1 and later as applicable).
• If patching cannot be done immediately, block all internet traffic to and from affected Confluence instances, as CISA directed.
• Restrict network access to Confluence to trusted management networks and remove direct public exposure where possible.
• After patching, hunt for prior compromise and rotate credentials and secrets stored in or accessible from Confluence.
• Monitor vendor advisory and CISA KEV guidance for any updated remediation steps.

Detection

• Review Confluence access logs for suspicious requests containing OGNL or expression-language payloads (for example ${...} patterns) in URLs or parameters.
• Look for unexpected child processes spawned by the Confluence Java process, such as shells or command interpreters.
• Check for newly created files, webshells, or modified JSP/plugin content under the Confluence installation and data directories.
• Correlate outbound network connections from the Confluence host to unfamiliar destinations, which may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.