CVE-2022-26134

Confirmed PUBLISHED

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to...

Atlassian · Confluence Data Center, Confluence Server

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

metasploit ransomware nuclei_scanner malware cisa

CVE Published: Jun 03, 2022
Exploitation Reported: Jun 02, 2022
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

28 version rows · page 2 of 2

Vendor	Product	Version	Status
Atlassian	Confluence Server	unspecified to < 7.17.4	Affected
Atlassian	Confluence Server	7.18.0 to < unspecified	Affected
Atlassian	Confluence Server	unspecified to < 7.18.1	Affected

CVE References

jira.atlassian.com/browse/CONFSERVER-79016 jira.atlassian.com · CVE Record https://jira.atlassian.com/browse/CONFSERVER-79016
packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection...
packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remot... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection...
packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022...
packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Name...

Show 1 more reference

confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-... confluence.atlassian.com · CVE Record https://confluence.atlassian.com/doc/confluence-security-advisory-202...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-06-02 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC
Tenable Blog	2026-06-02 14:20 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26134.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2022-06-02 00:00:00 UTC · CISA

Used in malware

Recorded 2022-06-02 00:00:00 UTC · CISA

Proof of concept available

Recorded 2022-06-03 08:01:49 UTC · GitHub

Weaknesses (CWE)

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26134.yaml	Apr 25, 2025

Recent Mentions

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable Blog · May 27, 2026

Tenable Research has developed a graph-based model linking 600+ threat groups to real-world customer exposures. It reveals which vulnerabilities sit at the intersection of severity, active exploitation, and organizational risk.Key takeawaysThe "patch everything" strategy is dead: Vulnerability prioritization based on exploitation risk offers a path forward. A directed graph model linking 600+ threat actors to vulnerabilities in 7,800 customer environments reveals that 68% of organizations carry at least one CVE previously exploited by a named adversary, and 321 tracked threat groups can reach at least one customer environment through an active vulnerability. Prevalence of "Elite Arsenal" CVEs requires immediate attention: The 242 "Elite Arsenal" CVEs — those meeting all three criteria of critical VPR (≥ 9), CISA KEV listing, and documented threat group exploitation — are nearly universally present across the studied customer base, with 241 of 242 actively detected. More than half are five or more years old, and 78% of the persistently exploited core are simultaneously weaponized by nation-state APTs, commodity malware operators, and ransomware gangs. Non-CVE exposures are universally dangerous: Non-CVE exposures, including misconfigurations, weak credentials, and end-of-life software, are present in virtually 100% of studied organizations, with 60% carrying at least one that maps to a tracked threat actor's preferred techniques. Preliminary modeling suggests these exposures may confer more breach risk than CVE-linked findings, yet no industry-standard scoring infrastructure exists to prioritize them.While the first two posts in this blog series documented the accelerating vulnerability flood and the widening remediation gap, today we answer the outstanding question: Where do these forces actually collide inside customer environments? Using a directed graph model that maps more than 600 tracked threat groups to vulnerabilities observed across 7,800 organizations,...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

MaskCyberSecurityTeam/CVE-2022-26134_Behinder_MemShell

github · Created 2023-02-04 06:51:47 UTC · 9 stars

cbk914/CVE-2022-26134_check

github · Created 2023-01-15 20:11:27 UTC · 3 stars

b4dboy17/CVE-2022-26134

github · Created 2022-10-24 19:00:25 UTC · 2 stars

latings/CVE-2022-26134

github · Created 2022-10-16 11:37:33 UTC · 0 stars

CVE-2022-26134

yigexioabai/CVE-2022-26134-cve1

github · Created 2022-10-15 06:01:53 UTC · 0 stars

skhalsa-sigsci/CVE-2022-26134-LAB

github · Created 2022-10-09 17:15:07 UTC · 3 stars

Detecting CVE-2022-26134 using Nuclei

shiftsansan/CVE-2022-26134-Console

github · Created 2022-08-22 09:40:43 UTC · 0 stars

CVE-2022-26134-Console

keven1z/CVE-2022-26134

github · Created 2022-07-23 14:38:11 UTC · 7 stars

远程攻击者在Confluence未经身份验证的情况下，可构造OGNL表达式进行注入，实现在Confluence Server或Data Center上执行任意代码,在现有脚本上修改了poc，方便getshell。

twoning/CVE-2022-26134-PoC

github · Created 2022-07-14 01:28:16 UTC · 2 stars

CVE-2022-26134-PoC

coskper-papa/CVE-2022-26134

github · Created 2022-07-08 12:24:21 UTC · 1 stars

confluence rce

Debajyoti0-0/CVE-2022-26134

github · Created 2022-07-05 07:04:50 UTC · 2 stars

Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE).

nxtexploit/CVE-2022-26134

github · Created 2022-07-05 04:30:42 UTC · 26 stars

Atlassian Confluence (CVE-2022-26134) - Unauthenticated Remote code execution (RCE)

ColdFusionX/CVE-2022-26134

github · Created 2022-06-24 10:33:13 UTC · 2 stars

Atlassian Confluence OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2022-26134)

kh4sh3i/CVE-2022-26134

github · Created 2022-06-21 11:49:48 UTC · 4 stars

[PoC] Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE)

AmoloHT/CVE-2022-26134

github · Created 2022-06-19 13:50:22 UTC · 14 stars

「💥」CVE-2022-26134 - Confluence Pre-Auth RCE

Chocapikk/CVE-2022-26134

github · Created 2022-06-13 23:01:39 UTC · 4 stars

CVE-2022-26134 - Pre-Auth Remote Code Execution via OGNL Injection

murataydemir/CVE-2022-26134

github · Created 2022-06-10 09:52:22 UTC · 1 stars

[CVE-2022-26134] Confluence Pre-Auth Object-Graph Navigation Language (OGNL) Injection

cai-niao98/CVE-2022-26134

github · Created 2022-06-09 02:11:58 UTC · 3 stars

CVE-2022-26134

Y000o/Confluence-CVE-2022-26134

github · Created 2022-06-07 16:42:36 UTC · 4 stars

whokilleddb/CVE-2022-26134-Confluence-RCE

github · Created 2022-06-07 11:17:25 UTC · 12 stars

Exploit for CVE-2022-26134: Confluence Pre-Auth Remote Code Execution via OGNL Injection

alcaparra/CVE-2022-26134

github · Created 2022-06-07 10:36:11 UTC · 4 stars

CVE-2022-26134 Confluence OGNL Injection POC

BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL

github · Created 2022-06-07 09:19:02 UTC · 337 stars

li8u99/CVE-2022-26134

github · Created 2022-06-07 06:57:02 UTC · 4 stars

Atlassian Confluence 远程代码执行漏洞（CVE-2022-26134）

CatAnnaDev/CVE-2022-26134

github · Created 2022-06-06 16:45:35 UTC · 3 stars

archanchoudhury/Confluence-CVE-2022-26134

github · Created 2022-06-06 06:16:47 UTC · 4 stars

This repository talks about Zero-Day Exploitation of Atlassian Confluence, it's defense and analysis point of view from a SecOps or Blue Team perspective

hev0x/CVE-2022-26134

github · Created 2022-06-06 02:43:06 UTC · 40 stars

Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134)

abhishekmorla/CVE-2022-26134

github · Created 2022-06-05 20:35:38 UTC · 10 stars

Vulnmachines/Confluence-CVE-2022-26134

github · Created 2022-06-05 12:23:34 UTC · 3 stars

SNCKER/CVE-2022-26134

github · Created 2022-06-04 11:16:28 UTC · 28 stars

[CVE-2022-26134]Confluence OGNL expression injected RCE with sandbox bypass.

shamo0/CVE-2022-26134

github · Created 2022-06-04 10:44:38 UTC · 1 stars

Confluence Server and Data Center - CVE-2022-26134 - Critical severity unauthenticated remote code execution vulnerability PoC

Brucetg/CVE-2022-26134

github · Created 2022-06-04 10:27:50 UTC · 2 stars

（CVE-2022-26134）an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server

kyxiaxiang/CVE-2022-26134

github · Created 2022-06-04 05:46:48 UTC · 3 stars

crowsec-edtech/CVE-2022-26134

github · Created 2022-06-03 19:24:30 UTC · 32 stars

CVE-2022-26134 - Confluence Pre-Auth RCE | OGNL injection

offlinehoster/CVE-2022-26134

github · Created 2022-06-03 08:01:49 UTC · 8 stars

Information and scripts for the confluence CVE-2022-26134

Confluence - Remote Code Execution

nuclei · Created Unknown

atlassian_confluence_namespace_ognl_injection

metasploit · Created Unknown

Metasploit module for CVE-2022-26134

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

2 Jun 2026 14:20 UTC about 2 months ago

2 Jun 2026 14:20 UTC · about 2 months ago

KEV confirmed by Tenable Blog

Exploitation attested by an external source
1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
3 Jun 2022 21:51 UTC about 4 years ago

3 Jun 2022 21:51 UTC · about 4 years ago

CVE published

Vulnerability disclosed publicly
3 Jun 2022 08:01 UTC about 4 years ago

3 Jun 2022 08:01 UTC · about 4 years ago

Public PoC available

Public proof-of-concept code published
2 Jun 2022 00:00 UTC about 4 years ago

2 Jun 2022 00:00 UTC · about 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
2 Jun 2022 00:00 UTC about 4 years ago

2 Jun 2022 00:00 UTC · about 4 years ago

First public exploitation report

Exploit observed in malware
25 Feb 2022 00:00 UTC over 4 years ago

25 Feb 2022 00:00 UTC · over 4 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2022-26134

{
  "cve_id": "CVE-2022-26134",
  "title": "In affected versions of Confluence Server and Data Center, an OGNL injection ...",
  "affected_vendor": "Atlassian",
  "affected_product": "Confluence Data Center, Confluence Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2022-26134

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API