CVE-2023-22518: Atlassian Confluence improper authorization allows admin account creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable full administrative compromise with active exploitation, KEV listing and near-maximum EPSS score.

What it is

Confluence Data Center and Server contain an improper authorization flaw that lets an unauthenticated attacker reset Confluence and create an instance administrator account. That account grants full administrative control, so the flaw threatens complete loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected.

Impact

An attacker gains a Confluence instance administrator account and can perform any administrative action, including full compromise of data and service availability.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed Confluence Data Center or Server instance is a candidate target.

Exploitation

CISA added it to KEV on 2023-11-07 with a 2023-11-28 due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99999 and a public exploit reference exists, so exploitation is active and widespread.

What to do

• Apply the Atlassian vendor patch for Confluence Data Center and Server immediately.
• If patching is not possible, apply the vendor's documented interim mitigations or take the instance offline.
• Restrict network access to Confluence instances so they are not reachable from untrusted networks.
• Audit for unauthorized administrator accounts and remove any that cannot be accounted for.
• Rotate credentials and secrets stored in or accessible from Confluence after remediation.

Detection

• Alert on creation of new Confluence administrator accounts, especially outside change windows.
• Monitor Confluence access logs for unauthenticated requests to setup or administrative endpoints.
• Hunt for unexpected Confluence configuration resets or setup wizard activity.
• Correlate Confluence host activity with known ransomware precursor behavior given the KEV ransomware flag.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.