Skip to content
OpenAdvisories
Critical · 9.8 Known exploited · Ransomware Scanner template Public exploit CVE-2022-26134 EUVD-2022-30701GHSA-653m-wpjp-54c4

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attac…

Published Jun 3, 2022 · Updated Oct 21, 2025 · Assigned by atlassian

Vendor: Atlassian Product: Confluence Data Center Product: Confluence Server Category: Web / CMS

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Affected products

VendorProductAffectedFixed
Atlassian Confluence Data Center next of 1.3.0 – < unspecified, unspecified – < 7.4.17, 7.13.0 – < unspecified, unspecified – < 7.13.7, 7.14.0 – < unspecified, unspecified – < 7.14.3, 7.15.0 – < unspecified, unspecified – < 7.15.2, 7.16.0 – < unspecified, unspecified – < 7.16.4, 7.17.0 – < unspecified, unspecified – < 7.17.4, 7.18… unspecified
Atlassian Confluence Server next of 1.3.0 – < unspecified, unspecified – < 7.4.17, 7.13.0 – < unspecified, unspecified – < 7.13.7, 7.14.0 – < unspecified, unspecified – < 7.14.3, 7.15.0 – < unspecified, unspecified – < 7.15.2, 7.16.0 – < unspecified, unspecified – < 7.16.4, 7.17.0 – < unspecified, unspecified – < 7.17.4, 7.18… unspecified

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 72 repositories · most starred shown

  • W01fh4cker/Serein ★ 1,244 · May 31, 2022

    【懒人神器】一款图形化、批量采集url、批量对采集的url进行各种nday检测的工具。可用于src挖掘、cnvd挖掘、0day利用、打造自己的武器库等场景。可以批量利用Actively Exploited Atlassian Confluence 0Day CVE-2022-26134和DedeCMS v5.7.87 SQL注入 CVE-2022-23337。

  • BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL ★ 339 · Jun 7, 2022
  • jbaines-r7/through_the_wire ★ 174 · Jun 3, 2022

    CVE-2022-26134 Proof of Concept

  • hev0x/CVE-2022-26134 ★ 44 · Jun 6, 2022

    Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134)

  • crowsec-edtech/CVE-2022-26134 ★ 31 · Jun 3, 2022

    CVE-2022-26134 - Confluence Pre-Auth RCE | OGNL injection

  • nxtexploit/CVE-2022-26134 ★ 29 · Jul 5, 2022

    Atlassian Confluence (CVE-2022-26134) - Unauthenticated Remote code execution (RCE)

  • SNCKER/CVE-2022-26134 ★ 26 · Jun 4, 2022

    [CVE-2022-26134]Confluence OGNL expression injected RCE with sandbox bypass.

  • SIFalcon/confluencePot ★ 20 · Jun 6, 2022

    Simple Honeypot for Atlassian Confluence (CVE-2022-26134)

  • AmoloHT/CVE-2022-26134 ★ 14 · Jun 19, 2022

    「💥」CVE-2022-26134 - Confluence Pre-Auth RCE

  • whokilleddb/CVE-2022-26134-Confluence-RCE ★ 13 · Jun 7, 2022

    Exploit for CVE-2022-26134: Confluence Pre-Auth Remote Code Execution via OGNL Injection

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References