A zero-day in Confluence Server and Data Center let anyone run code on the server. Internal knowledge bases are rarely treated as critical — they should be.
Publicly disclosed: 2 June 2022
On 2 June 2022 Atlassian warned about an actively exploited vulnerability in Confluence Server and Data Center. An OGNL injection allowed an unauthenticated attacker to execute code on the server simply by sending a crafted web request. Fixed versions were released the next day, and mass exploitation followed within hours of public details.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2022-26134 | Critical, CVSS 9.8 (OGNL injection, remote code execution) | All supported Confluence Server and Data Center versions at the time | 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 and later |
An internal tool is only internal if the internet cannot reach it.
Sources: Atlassian advisory, NVD CVE-2022-26134.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
