CVE-2023-22515: Atlassian Confluence Data Center and Server broken access control allows admin account creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable flaw with CVSS 9.8, confirmed in-the-wild exploitation, KEV listing with known ransomware use and near-maximum EPSS score.

What it is

Confluence Data Center and Server contain a broken access control flaw that lets an unauthenticated external attacker create unauthorized administrator accounts. Atlassian confirmed a handful of customers had already been exploited, and the issue is remotely reachable on publicly accessible instances. Atlassian Cloud sites (atlassian.net domains) are not affected.

Impact

An attacker gains full Confluence administrator access, which can lead to data theft, configuration changes and, per the referenced exploit material, remote code execution. Because the created accounts are legitimate admin accounts, activity can blend into normal administration.

Attack surface

Reachable over the network with no authentication and no user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N). Only publicly accessible Confluence Data Center and Server instances are exposed; Atlassian-hosted Cloud sites are not.

Exploitation

CISA added it to KEV on 2023-10-05 with a 2023-10-13 remediation due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99156 (99.9th percentile). Public exploit code is referenced (Packet Storm), so exploitation is active and widespread.

What to do

• Upgrade Confluence Data Center and Server to a vendor-fixed version immediately; follow the Atlassian advisory and FAQ for CVE-2023-22515.
• If patching cannot be done at once, apply Atlassian's documented interim mitigations or take the instance off the public internet.
• Audit all Confluence instances for unauthorized administrator accounts and remove any that are not legitimate.
• Restrict network access to Confluence admin interfaces and limit exposure of the instance to trusted networks.
• Treat any confirmed compromise as a full incident: rotate credentials, review logs and report positive findings to CISA per the KEV required action.

Detection

• Hunt for newly created or unexpected Confluence administrator accounts, especially accounts created outside change windows.
• Review Confluence access and audit logs for unauthenticated requests to administrative or setup endpoints preceding account creation.
• Monitor for the exploit activity described in public exploit write-ups and correlate with outbound or post-exploitation behavior.
• Check for signs of ransomware staging or lateral movement on hosts running Confluence, given the KEV ransomware flag.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.