Atlassian Confluence Zero-Day Vulnerability (CVE-2022-26134)

What happened

Atlassian disclosed a critical zero-day vulnerability (CVE-2022-26134) affecting Confluence Server and Data Center. The flaw allowed unauthenticated attackers to execute arbitrary code. CISA immediately added it to the Known Exploited Vulnerabilities (KEV) catalog and issued a Binding Operational Directive for federal agencies to block traffic or update immediately.

Technical mechanism

The vulnerability was an OGNL (Object-Graph Navigation Language) injection flaw that allowed unauthenticated remote code execution on the Confluence server.

Why it matters

Led to widespread exploitation by multiple threat actors, including state-sponsored groups, due to the prevalence of Confluence in enterprise environments.

Impact

Widespread exploitation attempts against internet-facing Confluence servers globally. Used by various actors to deploy webshells, ransomware, and establish persistence.

Response

Atlassian released emergency patches. CISA mandated immediate remediation for federal agencies. Organizations worldwide scrambled to patch or isolate their Confluence instances.

Defensive lessons

• Internet-facing applications must be strictly monitored and rapidly patched.
• Employ Web Application Firewalls (WAF) to detect and block common injection patterns.

Evidence register

1. CISA — CISA Adds One Known Exploited Vulnerability (CVE-2022-26134) to Catalog (verified)