CVE-2022-26134

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

VendorProductVersions
AtlassianConfluence Data Center>= next of 1.3.0, < unspecified; >= unspecified, < 7.4.17; >= 7.13.0, < unspecified; >= unspecified, < 7.13.7; >= 7.14.0, < unspecified; >= unspecified, < 7.14.3; >= 7.15.0, < unspecified; >= unspecified, < 7.15.2; >= 7.16.0, < unspecified; >= unspecified, < 7.16.4; >= 7.17.0, < unspecified; >= unspecified, < 7.17.4; >= 7.18.0, < unspecified; >= unspecified, < 7.18.1
AtlassianConfluence Server>= next of 1.3.0, < unspecified; >= unspecified, < 7.4.17; >= 7.13.0, < unspecified; >= unspecified, < 7.13.7; >= 7.14.0, < unspecified; >= unspecified, < 7.14.3; >= 7.15.0, < unspecified; >= unspecified, < 7.15.2; >= 7.16.0, < unspecified; >= unspecified, < 7.16.4; >= 7.17.0, < unspecified; >= unspecified, < 7.17.4; >= 7.18.0, < unspecified; >= unspecified, < 7.18.1

References

Timeline

Published
Jun 3, 2022
Last modified
Jun 17, 2026
Added to CISA KEV
Jun 2, 2022
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-261356.5A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the siCVE-2022-261369.8A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third pCVE-2022-261378.8A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked wCVE-2022-261389.8The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users gCVE-2022-26148.8Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via CVE-2022-261439.8The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers toCVE-2022-261446.1An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows CVE-2022-261465.4Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.CVE-2022-261479.8The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.CVE-2022-261489.8An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML CVE-2022-261497.2MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, becauCVE-2022-26156.5Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a
CVE-2022-26134: Critical severity, CVSS 9.8 | Vulnix