9

CVE-2023-22522: atlassian confluence_data_center

Modified
Published 06-12-2023Last modified 25-02-2026

Vulnerability summary

CVE-2023-22522 is a critical (CVSS 9.0) vulnerability in atlassian confluence_data_center. EPSS estimates a 12.95% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities. Fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1.

Priority
Prioritisesevere

Severe, CVSS 9 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 13% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.0/10
010
Critical · v3.0 (CVE.org)
EPSS score
12.95%
0%100%
Medium · +0.10 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 06-12-2023
    PublishedVulnerability first disclosed.
  2. 25-02-2026
    Last modifiedVulnerability information updated.

Description

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

12.95%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Increase +0.10 pp

From 12.84% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian2 products
  • confluence_data_center≥ 4.0.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 7.20.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 8.0.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 8.6.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 4.0, < 7.19.17 | ≥ 8.0.0, < 8.4.5 | ≥ 8.5.0, < 8.5.4 | ≥ 8.6.0, < 8.6.2 | 8.7.0
  • confluence_server≥ 4.0.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 7.20.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 8.0.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 8.6.0 (fixed in 7.19.17, 8.4.5, 8.5.4, 8.6.2, 8.7.1) | ≥ 4.0, < 7.19.17 | ≥ 8.0.0, < 8.4.5 | ≥ 8.5.0, < 8.5.4

1 vendor · 2 products

References

2 links