8.3

CVE-2025-22166: atlassian confluence_data_center

Analyzed
Published 21-10-2025Last modified 21-10-2025

Vulnerability summary

CVE-2025-22166 is a high (CVSS 8.3) vulnerability in atlassian confluence_data_center. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 43.1% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.3/10
010
High · v4.0 (CVE.org)
EPSS score
0.50%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 21-10-2025
    PublishedVulnerability first disclosed.
  2. 21-10-2025
    Last modifiedVulnerability information updated.

Description

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Atlassian (Internal) program.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian2 products
  • confluence_data_center9.5.1 to 9.5.4 | 9.4.0 to 9.4.1 | 9.3.1 to 9.3.2 | 9.2.0 to 9.2.6 | 9.1.0 to 9.1.1 | 9.0.1 to 9.0.3 | 8.9.0 to 8.9.8 | 8.8.0 to 8.8.1 | 8.7.1 to 8.7.2 | 8.6.1 to 8.6.2 | 8.5.3 to 8.5.24 | 7.19.16 to 7.19.30 | ≥ 8.5.0, < 8.5.25 | ≥ 9.2.0, < 9.2.7 | ≥ 10.0.0, < 10.0.2
  • confluence_server≥ 8.5.0, < 8.5.25 | ≥ 9.2.0, < 9.2.7 | ≥ 10.0.0, < 10.0.2

1 vendor · 2 products

References

2 links