# CVE-2022-26134: Atlassian Confluence - RCE

> Live exploitation tracking for CVE-2022-26134 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-26134

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Atlassian Confluence Server
- **Weaknesses:** CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'))
- **Tags:** enterprise_software, wiki

## Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

## CrowdSec analysis

[CVE-2022-26134](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-26134) is a critical OGNL injection vulnerability in Confluence Server and Data Center that allows unauthenticated attackers to execute arbitrary code on affected instances.

CrowdSec has been tracking this vulnerability and its exploits since 17th of October 2022.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2022-26134 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-26134 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-26134 is currently experiencing high visibility and active exploitation across the internet.

 The attack does not target a specific endpoint.

## Timeline

- 2022-06-02: CISA KEV. CVE-2022-26134 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-06-03: CVE Published. CVE-2022-26134 is published to NVD.
- 2022-06-06: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2022-10-17: Rule Released. CrowdSec releases a rule to detect CVE-2022-26134 exploitation attempts against the CrowdSec Network.
- 2022-10-17: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-26134 for the first time.

## References

- https://jira.atlassian.com/browse/CONFSERVER-79016
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26134.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-26134) follows observed exploitation activity for CVE-2022-26134. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.