Vulnerabilities/Atlassian/CVE-2022-26134

CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 2 Jun 2022

Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.

Recommended action

Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

CISA due date 6 Jun 2022 · CWE-917

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
Confluence Data Centernext of 1.3.0Unknown
Confluence Data Centerbefore 7.4.17Unknown
Confluence Data Center7.13.0Unknown
Confluence Data Centerbefore 7.13.7Unknown
Confluence Data Center7.14.0Unknown
Show 23 more rows
Confluence Data Centerbefore 7.14.3Unknown
Confluence Data Center7.15.0Unknown
Confluence Data Centerbefore 7.15.2Unknown
Confluence Data Center7.16.0Unknown
Confluence Data Centerbefore 7.16.4Unknown
Confluence Data Center7.17.0Unknown
Confluence Data Centerbefore 7.17.4Unknown
Confluence Data Center7.18.0Unknown
Confluence Data Centerbefore 7.18.1Unknown
Confluence Servernext of 1.3.0Unknown
Confluence Serverbefore 7.4.17Unknown
Confluence Server7.13.0Unknown
Confluence Serverbefore 7.13.7Unknown
Confluence Server7.14.0Unknown
Confluence Serverbefore 7.14.3Unknown
Confluence Server7.15.0Unknown
Confluence Serverbefore 7.15.2Unknown
Confluence Server7.16.0Unknown
Confluence Serverbefore 7.16.4Unknown
Confluence Server7.17.0Unknown
Confluence Serverbefore 7.17.4Unknown
Confluence Server7.18.0Unknown
Confluence Serverbefore 7.18.1Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 2 Jun 2022 · Added to CISA KEV
  • 6 Jun 2022 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.