CVE-2022-26134 Explained: Confluence Server Critical OGNL Zero-Day
A CVSS 10.0 pre-authentication OGNL injection zero-day in Atlassian Confluence Server and Data Center. Exploited in the wild before Atlassian had a patch. Immediate mass exploitation followed disclosure.
Founder & Cybersecurity Evangelist
CVE-2022-26134 is a maximum-severity (CVSS 10.0) OGNL injection vulnerability in Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. Unlike CVE-2021-26084 — a similar OGNL vulnerability in the same product from the prior year — CVE-2022-26134 was disclosed as a zero-day with confirmed active exploitation already underway before Atlassian released patches.
Volexity, a cybersecurity incident response firm, discovered the vulnerability during an active intrusion investigation in late May 2022. They notified Atlassian on June 1; Atlassian published an advisory June 2 with an immediate recommendation to take Confluence offline or block all internet access while patches were developed. Patches were released June 3-6 depending on the affected version.
The Exploit: OGNL Injection via HTTP Request Path
CVE-2022-26134 is an OGNL (Object-Graph Navigation Language) injection vulnerability in Atlassian Confluence's HTTP request handling. The vulnerability allows an attacker to inject OGNL expressions directly into HTTP request URI paths that are processed by Confluence's WebWork action framework.
Unlike some template injection vulnerabilities that require a specific content type or parameter, CVE-2022-26134 exploits the URL path itself. A crafted HTTP GET or POST request with a malicious OGNL expression in the path triggers evaluation of that expression by the Confluence server before routing or authentication checks occur in certain code paths.
The OGNL expression executes in the context of the Confluence server process, with access to the Java runtime environment, system properties, and the ability to call arbitrary Java methods — including those that spawn operating system processes. The result is unauthenticated, pre-routing code execution on the Confluence server.
All supported versions of Confluence Server and Data Center before the patch releases are affected. This includes versions 1.3.0 through the patched versions — effectively every production Confluence Server and Data Center instance worldwide at the time of disclosure. Confluence Cloud instances hosted by Atlassian were not affected.
Identify Confluence Server instances
Scan internet-facing infrastructure for Confluence Server and Data Center deployments. Confluence's login page and error responses are distinctive. Shodan, Censys, and active scanning identified tens of thousands of exposed instances within hours of the advisory.
Send OGNL injection in URL path
Craft an HTTP GET or POST request where the URL path contains an OGNL expression. Send to any Confluence endpoint — authentication is not required, and the expression evaluates before authentication logic executes.
Execute OS command
The OGNL expression calls Java's Runtime.exec() or ProcessBuilder to execute an OS command as the operating system user running the Confluence process. On Linux deployments, this is typically the confluence OS user; on Windows, the application pool user.
Deploy implant or create reverse shell
First-wave exploitation deployed cryptomining software (XMRig), web shells, and Cobalt Strike beacons. Nation-state actors conducted targeted exploitation for espionage access to Confluence content before the vulnerability became public.
Harvest Confluence data
With RCE on Confluence, access all wiki pages, attachments, and the Confluence database — including potentially credentials, architecture documentation, source code repositories linked from Confluence, and internal operational data.
Zero-Day Exploitation Timeline and Threat Actor Activity
The timeline of CVE-2022-26134 is particularly notable because exploitation was confirmed before the advisory was published. Volexity discovered the vulnerability during a Memorial Day weekend incident response engagement for a customer whose Confluence server had been compromised.
The initial exploitation they observed deployed an in-memory web shell — an implant that existed only in the Confluence server's Java process memory, leaving no files on disk — making it particularly difficult to detect and attribute. The attacker appeared to have operational security practices consistent with sophisticated threat actors.
Between Atlassian's advisory on June 2 and patch availability on June 3-6, Atlassian's official guidance was to take Confluence offline entirely. Organizations that followed this guidance were protected. Those that kept vulnerable instances running faced immediate exploitation — within hours of the advisory, mass scanning activity was detected at internet scale.
Post-patch exploitation included cryptomining campaigns deploying XMRig, multiple ransomware affiliate probing campaigns building target lists, and nation-state actors attributed to Chinese cyber operations who appeared to have had prior knowledge of the vulnerability based on the sophistication of pre-advisory exploitation artifacts.
“This is an OGNL injection vulnerability that affects Confluence Server and Data Center. An unauthenticated user can execute arbitrary code on a Confluence Server or Data Center instance.”
— Atlassian Security Advisory, CVE-2022-26134, June 2022
Patching and Securing Against CVE-2022-26134
Patches were released between June 3 and June 6, 2022 depending on the Confluence version. For all unpatched systems, the priority is immediate patching or taking Confluence offline.
Upgrade to a patched Confluence version immediately
Upgrade to 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, or 7.18.1 depending on your current version train. Refer to the Atlassian advisory for the complete version matrix. If you cannot patch immediately, take Confluence offline.
Block internet access to Confluence as an interim measure
If patching is not immediately possible, block all inbound internet access to the Confluence instance using network ACLs or firewall rules. The exploit requires network access to Confluence HTTPS — eliminating that access eliminates remote exploitation.
Search for indicators of compromise
Examine Confluence access logs for requests with OGNL expression patterns (${, %{, and similar OGNL syntax) in URL paths. Look for unusual process spawning from the Confluence JVM process (commands like wget, curl, bash, powershell). Check for new files in Confluence directories.
Look specifically for in-memory web shells
In-memory implants leave no files on disk. Use memory forensics tools or endpoint detection solutions that inspect JVM process memory for loaded classes that do not correspond to known Confluence jar files or standard Java runtime classes.
Rotate credentials stored in or accessible from Confluence
Confluence frequently stores credentials in pages (database passwords, API keys, service accounts). Rotate all such credentials after patching. Also rotate the Confluence application's own database credentials and any accounts with privileged access to the Confluence server.
The bottom line
CVE-2022-26134 is the second critical OGNL injection zero-day in Confluence in less than a year — following CVE-2021-26084 in August 2021. The same product, the same vulnerability class, both scores of 9.8 or 10.0, both exploited within hours of public knowledge. This pattern should inform how organizations treat Confluence patching going forward.
Confluence is not a low-risk internal wiki. It is a high-value target because of what it contains: credentials, architecture documentation, process runbooks, and connectivity to code repositories. Nation-state actors treat it as an intelligence collection target. Ransomware operators treat it as an initial access vector. Both groups have demonstrated they will zero-day it when the opportunity exists.
The answer is not to avoid Confluence — it is to treat it as a critical-risk application requiring the same patching urgency, network segmentation, and access control rigor as production systems.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.