PoC Index

CVE-2022-26134

KEV RANSOMWARECRITICAL 9.8EPSS 100.0%

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
100.00% chance of exploitation in the next 30 days, 100th percentile
CISA KEV
added 2022-06-02, used in ransomware campaigns
Nuclei
critical · CWE-917
Published
2022-06-03
Updated
2025-10-21

Proof-of-concept exploits (92)

Nuclei templates (1)

Metasploit modules (1)

ExploitDB entries (1)

Vulhub environments (1)

Exploit collections (1)

References

Related