CVE-2022-26134

highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEU KEV · CNWEPSS 1.000 · 100. PerzentilExploit · waffenfähigEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 72 exploits · waffenfähig

Likely / severe?

100.0% (100th) EPSS

CVSS 7.5 · high

Is it mine?

56 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

hinzugefügt 2022-06-02beheben bis 2022-06-06

erforderliche Maßnahme Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

EU KEVgemeldet von CNWgemeldet 2026-07-31gepatcht 2022-06-02APT

OGNL injection vulnerability allows an unauthenticated attacker to execute arbitrary code on an instance.

EPSS · bewertet 2026-10-27

Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-917USprimärCWE-20US

ATT&CK-Techniken

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

T1190Exploit Public-Facing Application — This vulnerability is exploited by placing a payload in the URI of an HTTP request to a public-facing server.Ausnutzung

Exploits (72)

Öffentlicher Proof-of-Concept- und Exploit-Code.

exploit/multi/http/atlassian_confluence_namespace_ognl_injectionAtlassian Confluence Namespace OGNL Injectionwaffenfähig · metasploit
EDB-50952Confluence Data Center 7.18.0 - Remote Code Execution (RCE)PoC · exploit_db
0xAgun/CVE-2022-261340xAgun/CVE-2022-26134PoC · poc_in_github
1337in/CVE-2022-26134webCVE-2022-26134 web payloadPoC · poc_in_github
404fu/CVE-2022-26134-POC404fu/CVE-2022-26134-POCPoC · poc_in_github
AmoloHT/CVE-2022-26134「💥」CVE-2022-26134 - Confluence Pre-Auth RCEPoC · poc_in_github

betroffene Produkte (56)

Betroffene Produkte und Versionsbereiche.

Atlassian Confluence Data Center7.13.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Center7.14.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Center7.15.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Center7.16.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Center7.17.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Center7.18.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Centernext of 1.3.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.13.7enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.14.3enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.15.2enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.16.4enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.17.4enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.18.1enisa_euvdEU
Atlassian Confluence Data Centerunspecified → 7.4.17enisa_euvdEU
Atlassian Confluence Server7.13.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Server7.14.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Server7.15.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Server7.16.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Server7.17.0 → unspecifiedenisa_euvdEU
Atlassian Confluence Server7.18.0 → unspecifiedenisa_euvdEU

20 von 56 angezeigt

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

veröffentlicht 2022-06-03geändert 2026-07-13

verwandt (254)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-41901US	—OT kritisch	0.43% (37th)	Exploit	2026-05-12
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mech…
CVE-2026-40478US	—OT kritisch	1.10% (66th)	—	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression…
CVE-2026-40477US	—OT kritisch	0.85% (58th)	Exploit	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression exec…
CVE-2022-22963US	critical9.8OT kritisch	99.9% (100th)	KEV	2022-04-01
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a r…
CVE-2022-22947US	critical10.0OT kritisch	98.3% (100th)	KEV	2022-03-03
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unse…

+249 weitere

Referenzen (23)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan