Vulnerabilities/Atlassian/CVE-2023-22518
CVE-2023-22518: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownPatch available
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 7 Nov 2023
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 28 Nov 2023 · CWE-863
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Confluence Data Center | < 1.0.0 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Data Center | >= 1.0.0 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Data Center | >= 7.19.16 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Data Center | >= 8.3.4 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Data Center | >= 8.4.4 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
Show 9 more rows
| Confluence Data Center | >= 8.5.3 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Data Center | >= 8.6.1 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Server | < 1.0.0 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Server | >= 1.0.0 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Server | >= 7.19.16 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Server | >= 8.3.4 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Server | >= 8.4.4 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Server | >= 8.5.3 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
| Confluence Server | >= 8.6.1 | < 1.0.0, >= 7.19.16, >= 8.3.4, >= 8.4.4, >= 8.5.3, >= 8.6.1 |
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 7 Nov 2023 · Added to CISA KEV
- 28 Nov 2023 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.