CVE-2023-22515

Confirmed PUBLISHED

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown...

Atlassian · Confluence Data Center, Confluence Server

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 99.2%

At a Glance

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

metasploit nuclei_scanner cisa malware dotnet ransomware

CVE Published: Oct 04, 2023
Exploitation Reported: Apr 25, 2025
CVSS: 9.8 Critical
EPSS: 99.2%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

44 version rows · page 1 of 2

Vendor	Product	Version	Status
Atlassian	Confluence Data Center	< 8.0.0	Unaffected
Atlassian	Confluence Data Center	>= 8.0.0	Affected
Atlassian	Confluence Data Center	>= 8.0.1	Affected
Atlassian	Confluence Data Center	>= 8.0.2	Affected
Atlassian	Confluence Data Center	>= 8.0.3	Affected
Atlassian	Confluence Data Center	>= 8.1.3	Affected
Atlassian	Confluence Data Center	>= 8.1.4	Affected
Atlassian	Confluence Data Center	>= 8.2.0	Affected
Atlassian	Confluence Data Center	>= 8.2.1	Affected
Atlassian	Confluence Data Center	>= 8.2.2	Affected
Atlassian	Confluence Data Center	>= 8.2.3	Affected
Atlassian	Confluence Data Center	>= 8.3.0	Affected
Atlassian	Confluence Data Center	>= 8.3.1	Affected
Atlassian	Confluence Data Center	>= 8.3.2	Affected
Atlassian	Confluence Data Center	>= 8.4.0	Affected
Atlassian	Confluence Data Center	>= 8.4.1	Affected
Atlassian	Confluence Data Center	>= 8.4.2	Affected
Atlassian	Confluence Data Center	>= 8.5.0	Affected
Atlassian	Confluence Data Center	>= 8.5.1	Affected
Atlassian	Confluence Data Center	>= 8.3.3	Unaffected
Atlassian	Confluence Data Center	>= 8.4.3	Unaffected
Atlassian	Confluence Data Center	>= 8.5.2	Unaffected
Atlassian	Confluence Server	< 8.0.0	Unaffected
Atlassian	Confluence Server	>= 8.0.0	Affected
Atlassian	Confluence Server	>= 8.0.1	Affected

CVE References

packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenti... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unau...
confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515 confluence.atlassian.com · CVE Record https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515
confluence.atlassian.com/pages/viewpage.action confluence.atlassian.com · CVE Record https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276
jira.atlassian.com/browse/CONFSERVER-92475 jira.atlassian.com · CVE Record https://jira.atlassian.com/browse/CONFSERVER-92475

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-10-05 00:00 UTC
The Shadowserver	2026-05-31 00:00 UTC
Tenable Blog	2026-06-02 14:20 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22515.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 10.0 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2025-04-25 00:00:00 UTC · The Shadowserver

Used in malware

Recorded 2023-10-05 00:00:00 UTC · The Shadowserver

Proof of concept available

Recorded 2023-10-06 20:29:44 UTC · GitHub

Weaknesses (CWE)

CWE-20

Improper Input Validation

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22515.yaml	Apr 25, 2025

Recent Mentions

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable Blog · May 27, 2026

Tenable Research has developed a graph-based model linking 600+ threat groups to real-world customer exposures. It reveals which vulnerabilities sit at the intersection of severity, active exploitation, and organizational risk.Key takeawaysThe "patch everything" strategy is dead: Vulnerability prioritization based on exploitation risk offers a path forward. A directed graph model linking 600+ threat actors to vulnerabilities in 7,800 customer environments reveals that 68% of organizations carry at least one CVE previously exploited by a named adversary, and 321 tracked threat groups can reach at least one customer environment through an active vulnerability. Prevalence of "Elite Arsenal" CVEs requires immediate attention: The 242 "Elite Arsenal" CVEs — those meeting all three criteria of critical VPR (≥ 9), CISA KEV listing, and documented threat group exploitation — are nearly universally present across the studied customer base, with 241 of 242 actively detected. More than half are five or more years old, and 78% of the persistently exploited core are simultaneously weaponized by nation-state APTs, commodity malware operators, and ransomware gangs. Non-CVE exposures are universally dangerous: Non-CVE exposures, including misconfigurations, weak credentials, and end-of-life software, are present in virtually 100% of studied organizations, with 60% carrying at least one that maps to a tracked threat actor's preferred techniques. Preliminary modeling suggests these exposures may confer more breach risk than CVE-linked findings, yet no industry-standard scoring infrastructure exists to prioritize them.While the first two posts in this blog series documented the accelerating vulnerability flood and the widening remediation gap, today we answer the outstanding question: Where do these forces actually collide inside customer environments? Using a directed graph model that maps more than 600 tracked threat groups to vulnerabilities observed across 7,800 organizations,...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

spareack/CVE-2023-22515-NSE

github · Created 2024-07-18 19:55:59 UTC · 4 stars

Vulnerability checking tool via Nmap Scripting Engine

fyx1t/NSE--CVE-2023-22515

github · Created 2024-04-26 17:57:33 UTC · 2 stars

NSE script for checking the presence of CVE-2023-22515

rxerium/CVE-2023-22515

github · Created 2024-02-24 16:04:35 UTC · 2 stars

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

LucasPDiniz/CVE-2023-22515

github · Created 2023-11-08 05:18:30 UTC · 2 stars

Server Broken Access Control in Confluence - CVE-2023-22515

joaoviictorti/CVE-2023-22515

github · Created 2023-10-22 23:37:56 UTC · 3 stars

CVE-2023-22515 (Confluence Broken Access Control Exploit)

youcannotseemeagain/CVE-2023-22515_RCE

github · Created 2023-10-20 08:23:47 UTC · 19 stars

Confluence后台rce

Le1a/CVE-2023-22515

github · Created 2023-10-13 05:18:54 UTC · 6 stars

Confluence Data Center & Server 权限提升漏洞 Exploit

sincere9/CVE-2023-22515

github · Created 2023-10-12 02:41:23 UTC · 25 stars

Confluence未授权添加管理员用户漏洞利用脚本

kh4sh3i/CVE-2023-22515

github · Created 2023-10-11 11:21:47 UTC · 4 stars

CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data Center and Server

ad-calcium/CVE-2023-22515

github · Created 2023-10-11 08:42:17 UTC · 107 stars

Confluence未授权添加管理员用户(CVE-2023-22515)漏洞利用工具

Chocapikk/CVE-2023-22515

github · Created 2023-10-10 21:40:09 UTC · 133 stars

CVE-2023-22515: Confluence Broken Access Control Exploit

j3seer/CVE-2023-22515-POC

github · Created 2023-10-10 18:45:10 UTC · 8 stars

Poc for CVE-2023-22515

ErikWynter/CVE-2023-22515-Scan

github · Created 2023-10-06 20:29:44 UTC · 75 stars

Scanner for CVE-2023-22515 - Broken Access Control Vulnerability in Atlassian Confluence

Atlassian Confluence - Privilege Escalation

nuclei · Created Unknown

atlassian_confluence_rce_cve_2023_22515

metasploit · Created Unknown

Metasploit module for CVE-2023-22515

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

2 Jun 2026 14:20 UTC about 2 months ago

2 Jun 2026 14:20 UTC · about 2 months ago

KEV confirmed by Tenable Blog

Exploitation attested by an external source
31 May 2026 00:00 UTC about 2 months ago

31 May 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
6 Oct 2023 20:29 UTC almost 3 years ago

6 Oct 2023 20:29 UTC · almost 3 years ago

Public PoC available

Public proof-of-concept code published
5 Oct 2023 00:00 UTC almost 3 years ago

5 Oct 2023 00:00 UTC · almost 3 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
5 Oct 2023 00:00 UTC almost 3 years ago

5 Oct 2023 00:00 UTC · almost 3 years ago

First public exploitation report

Exploit observed in malware
4 Oct 2023 14:00 UTC almost 3 years ago

4 Oct 2023 14:00 UTC · almost 3 years ago

CVE published

Vulnerability disclosed publicly
1 Jan 2023 00:01 UTC over 3 years ago

1 Jan 2023 00:01 UTC · over 3 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2023-22515

{
  "cve_id": "CVE-2023-22515",
  "title": "Atlassian has been made aware of an issue reported by a handful of customers ...",
  "affected_vendor": "Atlassian",
  "affected_product": "Confluence Data Center, Confluence Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99156,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2023-22515

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API