CVE-2023-22527: Atlassian Confluence Data Center and Server template injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with a CVSS of 9.8, KEV listing with ransomware use, and near-maximum EPSS makes this an urgent patch.

What it is

Older versions of Confluence Data Center and Server contain a template injection flaw (CWE-74) that lets an unauthenticated attacker execute code on the instance. Atlassian states recent supported versions are not affected because the issue was mitigated during routine updates, but any instance still on an affected older release is exposed.

Impact

An attacker gains remote code execution on the Confluence server, which can lead to full compromise of the instance and any data or credentials it holds.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw is in request handling that processes attacker-supplied template input.

Exploitation

It is listed in CISA KEV with a due date of 2024-02-14 and flagged for known ransomware campaign use, and public exploit code is referenced (Packet Storm, Vicarius). EPSS is 0.99984 (99.982nd percentile), indicating near-certain exploitation activity.

What to do

• Upgrade Confluence Data Center and Server to the latest supported version, which Atlassian states is not affected.
• If immediate upgrade is not possible, apply the vendor mitigations from the Atlassian advisory or take the instance offline until patched.
• Restrict network access to Confluence instances so they are not exposed to untrusted networks.
• Review the instance for signs of compromise and rotate credentials and secrets stored in or accessible from Confluence.
• Track remediation against the CISA KEV due date of 2024-02-14.

Detection

• Monitor Confluence access logs for suspicious POST requests to template or OGNL-related endpoints from unauthenticated sources.
• Look for unexpected child processes spawned by the Confluence Java process (for example shells or command interpreters).
• Alert on outbound network connections from the Confluence host to unfamiliar destinations.
• Review file system changes in Confluence web directories and any new or modified JSP or template files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.