Vulnerabilities/Atlassian/CVE-2023-22527
CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownPatch available
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 24 Jan 2024
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 14 Feb 2024 · CWE-74
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Confluence Data Center | < 8.0.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.0.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.1.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.2.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.3.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
Show 22 more rows
| Confluence Data Center | >= 8.4.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.5.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.5.1 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.5.2 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.5.3 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.5.4 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.6.0 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Data Center | >= 8.7.1 | < 8.0.0, >= 8.5.4, >= 8.6.0, >= 8.7.1 |
| Confluence Server | < 8.0.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.0.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.1.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.2.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.3.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.4.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.5.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.5.1 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.5.2 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.5.3 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.5.4 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| Confluence Server | >= 8.6.0 | < 8.0.0, >= 8.5.4, >= 8.6.0 |
| confluence_data_center | 8.0.0 to before 8.5.4 | Unknown |
| confluence_server | 8.0.0 to before 8.5.4 | Unknown |
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 24 Jan 2024 · Added to CISA KEV
- 14 Feb 2024 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.