CVE-2022-26138

What it actually does

The affected Atlassian Questions for Confluence app versions 2.7.34, 2.7.35, and 3.0.2 create a local Confluence account named "disabledsystemuser" in the "confluence-users" group with a hardcoded password. Because the account is created by the application and can be used remotely, an unauthenticated attacker who knows the hardcoded password can authenticate to Confluence as a normal user. The attacker can then read any Confluence content available to the confluence-users group and may be able to modify pages, upload attachments, create content, or pivot further depending on the permissions granted to that group and any additional privileges assigned to the account.

Why it matters to the business

Successful exploitation can expose internal documentation, credentials embedded in wiki pages, architecture diagrams, runbooks, incident procedures, customer or employee data, and other sensitive business information stored in Confluence. If the account has write access, attackers can tamper with documentation, plant malicious links, stage phishing content, or use trusted wiki pages to support lateral movement. This vulnerability is listed in CISA KEV, has very high EPSS likelihood, and has been exploited in the wild, so internet-accessible Confluence instances running the affected app should be treated as high-priority exposure even though the CISA remediation deadline of 2022-08-19 has passed.

How an attack unfolds

An attacker identifies a Confluence Server or Data Center instance and determines that the Atlassian Questions for Confluence app is installed in one of the affected versions. Because those app versions create the "disabledsystemuser" account with a hardcoded password, the attacker uses the known credential pair to log in through the normal Confluence authentication flow. Once authenticated, the attacker has the same content visibility and actions available to members of the "confluence-users" group. They can enumerate spaces, read pages and attachments, search for secrets or operational documentation, and, where permissions allow, create or modify content. In follow-on activity, the attacker may use exposed credentials, API tokens, deployment instructions, VPN details, or administrative runbooks found in Confluence to expand access into other systems.

How to fix it

Upgrade Atlassian Questions for Confluence to a non-affected version according to Atlassian guidance, or uninstall/disable the app if it is not required. Affected app versions are 2.7.34, 2.7.35, and 3.0.2. Remove or disable the "disabledsystemuser" account if present, and ensure it is not a member of "confluence-users" or any other group. Reset the password if the account cannot be immediately removed, but do not rely on password reset alone if the vulnerable app version remains installed. Review Confluence group permissions, especially broad permissions granted to "confluence-users", and restrict access to sensitive spaces using least privilege. If the instance was internet-accessible while vulnerable, assume credentials and sensitive content available to ordinary Confluence users may have been exposed and rotate secrets found in Confluence.

How to confirm the fix worked

Confirm the Atlassian Questions for Confluence app is not installed in versions 2.7.34, 2.7.35, or 3.0.2. In Confluence administration, verify whether a user named "disabledsystemuser" exists; if present, confirm it is disabled or removed and is not a member of "confluence-users" or privileged groups. Validate that the account cannot authenticate through the Confluence login page or API. Review the application user directory, group membership, and audit logs to confirm no successful recent logins or content access occurred under that username. Where possible, test from an unauthenticated network path that the known account cannot be used to log in. Also verify that sensitive Confluence spaces are not broadly readable by all members of "confluence-users" unless intentionally approved.

Typical attack path

1. Discover an exposed Atlassian Confluence Server or Data Center instance.
2. Fingerprint the instance or app metadata to determine whether Atlassian Questions for Confluence is installed and potentially affected.
3. Authenticate to Confluence using the hardcoded "disabledsystemuser" account credentials.
4. Enumerate accessible Confluence spaces, pages, comments, and attachments using the web interface or REST API.
5. Search for sensitive information such as passwords, API keys, deployment notes, architecture diagrams, incident runbooks, and administrator procedures.
6. Download or exfiltrate accessible content and attachments.
7. If permissions allow, modify pages or upload attachments to stage malicious links, phishing material, or persistence-supporting content.
8. Use information obtained from Confluence to attempt lateral movement or compromise of additional systems.

How to detect it

Hunt for evidence of authentication and activity by the hardcoded account "disabledsystemuser". Review Confluence application logs, access logs, audit logs, user directory records, reverse proxy or load balancer logs, web server logs, SSO logs if applicable, and endpoint telemetry from Confluence servers. Look for successful login events, failed login attempts, session creation, REST API calls, page views, search queries, attachment downloads, page edits, comment creation, or account/group changes associated with "disabledsystemuser". Pay particular attention to access from unfamiliar external IP addresses, unusual user agents, high-volume page or attachment retrieval, and activity shortly after public disclosure in July 2022 or during later scanning waves. If audit logging is limited, correlate HTTP requests to login endpoints and Confluence REST API paths with the username, session identifiers, and source IPs. For confirmed or suspected compromise, examine Confluence content for unauthorized changes, uploaded attachments, malicious links, newly created pages, and references to credential harvesting. Also search for secrets in pages accessed by the account and rotate them where exposure cannot be ruled out.

• disabledsystemuser
• confluence-users
• /login.action
• /dologin.action
• /rest/api/content
• /rest/api/search
• /rest/api/user
• /plugins/servlet/questions
• Questions for Confluence
• Atlassian Questions for Confluence
• Successful login.*disabledsystemuser
• Failed login.*disabledsystemuser
• user=disabledsystemuser
• username=disabledsystemuser

What your security team should do

• Treat affected, externally reachable Confluence instances as urgent because this issue is in CISA KEV, has a very high EPSS score, and has known in-the-wild exploitation.
• Immediately inventory Confluence Server and Data Center deployments for the Atlassian Questions for Confluence app and identify versions 2.7.34, 2.7.35, and 3.0.2.
• Upgrade, disable, or uninstall the vulnerable app, then remove or disable the "disabledsystemuser" account.
• Hunt for successful and failed logins, REST API activity, page views, searches, attachment downloads, and content modifications by "disabledsystemuser".
• If exploitation is suspected, preserve Confluence application logs, access logs, audit logs, reverse proxy logs, and relevant endpoint telemetry before remediation overwrites evidence.
• Rotate credentials, API tokens, SSH keys, cloud keys, deployment secrets, and service passwords that were stored in Confluence or accessible to the "confluence-users" group.
• Review Confluence permissions to reduce broad default access granted through "confluence-users" and restrict sensitive spaces to explicitly authorized groups.
• Place Confluence behind SSO, MFA, VPN, or other access controls where operationally feasible, while recognizing that compensating controls do not replace patching/removal of the vulnerable app.