CVE-2022-26134

What it actually does

CVE-2022-26134 is an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Confluence Data Center caused by OGNL expression injection. A remote attacker can send a crafted HTTP request that causes Confluence to evaluate attacker-controlled OGNL expressions, leading to arbitrary command execution with the privileges of the Confluence application process. Successful exploitation can allow full compromise of the Confluence host, including file access, credential theft, web shell deployment, malware execution, lateral movement, and service disruption.

Why it matters to the business

Internet-accessible Confluence systems are high-value targets because they often contain internal documentation, credentials, architecture details, runbooks, and links to other business systems. This vulnerability is known to be exploited in the wild, is listed in CISA KEV, has been associated with ransomware activity, and has an EPSS score indicating near-certain exploitation likelihood for exposed vulnerable systems. Compromise can result in data theft, ransomware deployment, interruption of collaboration services, regulatory exposure, and use of the Confluence server as a foothold into the wider network.

How an attack unfolds

An attacker identifies an exposed Atlassian Confluence Server or Data Center instance running an affected version. They send a specially crafted HTTP request containing OGNL payload content in a request path or related request component that Confluence processes before authentication. The vulnerable server evaluates the injected OGNL expression and executes attacker-supplied operating system commands as the Confluence service user. Attackers commonly use the first command execution to perform reconnaissance, download tooling, write a web shell or JSP file, spawn a reverse shell, or install cryptominers, botnet malware, or ransomware staging tools. After gaining execution, they may harvest configuration files and credentials, enumerate connected systems, access Confluence content, create persistence, and pivot to adjacent infrastructure.

How to fix it

Upgrade Confluence Server and Confluence Data Center to a fixed version immediately. Atlassian fixed the issue in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 or later; the safest approach is to move to the latest supported Confluence release available for the deployed branch. If immediate upgrade is not possible, disconnect vulnerable Confluence instances from the internet, restrict access to trusted networks or VPN, apply Atlassian-provided temporary mitigations only as an emergency measure, and monitor closely for compromise. Because exploitation was widespread before and shortly after disclosure, treat any exposed vulnerable instance as potentially compromised and perform incident response, credential rotation, and integrity validation after patching.

How to confirm the fix worked

Confirm the installed Confluence version is 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1, or a later supported fixed release. Verify that temporary mitigation files or configuration changes have not broken functionality and that the final remediation is an actual upgrade, not only network filtering. From an external perspective, confirm Confluence is not publicly reachable unless explicitly required and protected by compensating controls. Review HTTP access logs for exploit-pattern requests, validate there are no unexpected JSP files or modified application files under the Confluence installation and home directories, and check that the Confluence process has not spawned suspicious child processes. Run vulnerability scanners or vendor-specific checks against all Confluence Server and Data Center assets to verify that no affected versions remain.

Typical attack path

1. Scan the internet or internal network for Atlassian Confluence Server or Data Center instances.
2. Fingerprint Confluence versions or test for vulnerable OGNL injection behavior using crafted unauthenticated HTTP requests.
3. Send an OGNL injection payload that invokes operating system command execution.
4. Run initial commands such as whoami, id, uname, curl, wget, powershell, or certutil to validate execution and retrieve payloads.
5. Deploy a web shell, reverse shell, cryptominer, botnet implant, credential harvester, or ransomware staging component.
6. Access Confluence configuration, attachments, backups, and application data to collect sensitive information.
7. Use recovered secrets or host access to move laterally to databases, identity systems, source repositories, or other internal services.
8. Maintain persistence, exfiltrate data, disrupt services, or deploy ransomware.

How to detect it

Review Confluence access logs, reverse proxy logs, WAF logs, EDR telemetry, process creation logs, file integrity monitoring, and outbound network logs for evidence of exploitation. Key signs include unauthenticated requests containing OGNL syntax, URL-encoded expression language markers, references to xwork or webwork objects, and requests that trigger command execution. Examine Confluence application logs such as atlassian-confluence.log and web server access logs for suspicious request paths containing '$', '{', '}', '%7B', '%7D', 'ognl', 'getRuntime', 'ProcessBuilder', or command strings. On hosts, investigate any child process spawned by the Java/Confluence process, especially shell interpreters, PowerShell, curl, wget, certutil, chmod, bash, sh, python, perl, nc, ncat, or busybox. Search the Confluence installation and home directories for newly created JSP files, web shells, unauthorized plugins, unfamiliar binaries, modified template files, and unexpected cron or scheduled task entries. Review outbound connections from the Confluence server shortly after suspicious HTTP requests, especially to unknown IPs, file-sharing hosts, paste sites, cryptomining pools, or command-and-control infrastructure. Because exploitation has been associated with ransomware, also look for credential dumping, discovery commands, backup deletion, mass file encryption, unusual administrative logins, and lateral movement from the Confluence host.

• ${
• %24%7B
• %7B
• %7D
• ognl
• @java.lang.Runtime@getRuntime
• getRuntime().exec
• java.lang.ProcessBuilder
• webwork
• xwork.MethodAccessor
• ServletActionContext
• /confluence/pages/createpage-entervariables.action
• /pages/createpage-entervariables.action
• /template/aui/text-inline.vm
• /template/aui/text-inline.vm.bak
• /confluence/template/aui/text-inline.vm
• /confluence/template/aui/text-inline.vm.bak
• atlassian-confluence.log
• confluence_access.log
• catalina.out
• java.lang.UNIXProcess
• ProcessImpl.start
• cmd.exe /c
• /bin/sh -c
• /bin/bash -c
• powershell.exe
• wget http
• curl http
• certutil -urlcache
• chmod +x
• /tmp/
• /var/tmp/
• /dev/shm/
• *.jsp
• noop.jsp
• cmd.jsp
• shell.jsp
• login.jsp
• pwn.jsp
• whoami
• uname -a
• id
• ifconfig
• ip addr
• netstat -an
• crontab -l
• nc -e
• ncat -e
• bash -i

What your security team should do

• Immediately inventory all Atlassian Confluence Server and Data Center instances, including internet-facing, internal, test, and disaster recovery systems.
• Prioritize emergency upgrade or isolation of any instance running versions before 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, or 7.18.1.
• Because this vulnerability is in CISA KEV, has a missed remediation deadline of 2022-06-06, is actively exploited, and is associated with ransomware campaigns, treat exposed vulnerable systems as incident-response cases, not routine patching tasks.
• Hunt historical logs from at least the public exploitation window around June 2022 to the present for OGNL injection attempts, command execution artifacts, suspicious child processes, and unexpected web-accessible files.
• If compromise is suspected, preserve evidence before rebuilding, rotate Confluence database credentials, local service credentials, API tokens, administrator passwords, and any secrets stored in Confluence content or configuration.
• Review outbound network connections from Confluence hosts for downloads, reverse shells, cryptomining pools, command-and-control infrastructure, and unusual destinations.
• Rebuild from known-good media if web shells, unauthorized binaries, modified application files, or unexplained Confluence process child processes are found.
• Restrict Confluence administrative and user access through VPN, SSO, reverse proxy controls, WAF rules, and network segmentation where operationally feasible.
• Add detections for Confluence spawning shell utilities, script interpreters, network download tools, and writes of JSP files into web-accessible directories.
• Perform post-remediation validation and document ownership, exposure, version, and patch status for every Confluence deployment.