10

CVE-2023-22518: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

KEVRansomware
Analyzed
Published 31-10-2023Last modified 21-10-2025

Vulnerability summary

CVE-2023-22518 is a critical (CVSS 10.0) Incorrect Authorization vulnerability in Atlassian Confluence Data Center and Server. It is known to be exploited: CISA lists it, first on 07-11-2023. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1.

Priority
Act nowransomware

Known ransomware use (CISA, 07-11-2023)

Source freshness unavailable

How is this decided?
CVSS score
10.0/10
010
Critical · v3.0 (CVE.org)
EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareKnown useFlagged by CISA
Public exploits2reference, metasploit

Timeline

  1. 31-10-2023
    PublishedVulnerability first disclosed.
  2. 07-11-2023
    Added to CISA KEVExploitedAtlassian Confluence Data Center and Server Improper Authorization Vulnerability
  3. 28-11-2023
    CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 100.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
07-11-2023
Federal due date
28-11-2023
Ransomware
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. confluence.atlassian.com/security/… nvd.nist.gov/vuln/detail/CVE-2023-22518

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • MetasploitMetasploitremoteVerified

    Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518)

    exploit/multi/http/atlassian_confluence_unauth_backup

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian2 products
  • confluence_data_center≥ 1.0.0 (fixed in 7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1) | ≥ 1.0, < 7.19.16 | ≥ 7.20.0, < 8.3.4 | ≥ 8.4.0, < 8.4.4 | ≥ 8.5.0, < 8.5.3 | 8.6.0
  • confluence_server≥ 1.0.0 (fixed in 7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1) | ≥ 1.0, < 7.19.16 | ≥ 7.20.0, < 8.3.4 | ≥ 8.4.0, < 8.4.4 | ≥ 8.5.0, < 8.5.3 | 8.6.0

1 vendor · 2 products

References

4 links