{"id":"CVE-2023-22515","published":"2023-10-04T14:15:10Z","modified":"2026-06-17T05:35:37Z","title":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","vendor":"Atlassian","product":"Confluence Data Center and Server","tier":"core","eol":null,"description":{"text":"Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. \r\n\r\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.","provenance":"source","from":"NVD"},"summary":{"text":"Atlassian Confluence Data Center and Server contains a broken access control flaw, caused by improper input validation, in publicly accessible instances. An unauthenticated remote attacker over the network can exploit it, with no user interaction or prior authentication required, to create unauthorized Confluence administrator accounts and gain access to the instance.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:56:34Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99223,"percentile":0.99935,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-10-05","dueDate":"2023-10-13","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.","notes":"https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22515","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-04","exploitedFirstSeen":"2023-10-04","ransomware":true,"evidence":[{"url":"https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html","date":"2023-10-04"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-10-04"},{"url":"https://cisa.gov/news-events/alerts/2023/10/05/atlassian-releases-security-advisory-confluence-data-center-and-server","date":"2023-10-05"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-10-05"},{"url":"https://x.com/MsftSecIntel/status/1711871732644970856","date":"2023-10-10"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a","date":"2023-10-16"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2023-1107.pdf","date":"2023-11-07"},{"url":"https://www.aon.com/cyber-solutions/aon_cyber_labs/detecting-effluence-an-unauthenticated-confluence-web-shell/","date":"2023-11-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2023-22515","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2023-22515","date":"2023-11-15"}],"evidenceTotal":977,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515","tags":["Vendor Advisory"]},{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276","tags":["Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-92475","tags":["Issue Tracking","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515","tags":["Vendor Advisory"]},{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276","tags":["Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-92475","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n","confidence":"high"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n","confidence":"high"},{"id":"T1136","name":"Create Account","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n","confidence":"high"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-26655","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26655","exploited":true,"exploitedSince":"2023-10-05","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":25,"skipped":6,"earliest":"2023-10-06","earliestUrl":"https://github.com/ErikWynter/CVE-2023-22515-Scan","repos":[{"name":"Chocapikk/CVE-2023-22515","url":"https://github.com/Chocapikk/CVE-2023-22515","stars":153,"created":"2023-10-10"},{"name":"ad-calcium/CVE-2023-22515","url":"https://github.com/ad-calcium/CVE-2023-22515","stars":110,"created":"2023-10-11"},{"name":"ErikWynter/CVE-2023-22515-Scan","url":"https://github.com/ErikWynter/CVE-2023-22515-Scan","stars":79,"created":"2023-10-06"},{"name":"AIex-3/confluence-hack","url":"https://github.com/AIex-3/confluence-hack","stars":51,"created":"2023-10-30"},{"name":"s1incere/CVE-2023-22515","url":"https://github.com/s1incere/CVE-2023-22515","stars":25,"created":"2023-10-12"}]},"metasploit":[{"name":"Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control","module":"auxiliary/admin/http/atlassian_confluence_auth_bypass","type":"auxiliary","disclosureDate":"2023-10-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/atlassian_confluence_auth_bypass.rb"},{"name":"Atlassian Confluence Unauthenticated Remote Code Execution","module":"exploit/multi/http/atlassian_confluence_rce_cve_2023_22515","type":"exploit","disclosureDate":"2023-10-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb"}],"nuclei":[{"id":"CVE-2023-22515","name":"Atlassian Confluence - Privilege Escalation","severity":"critical","path":"http/cves/2023/CVE-2023-22515.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22515.yaml"}],"first":{"date":"2023-10-04","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/atlassian_confluence_auth_bypass.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059.007","T1136"],"provenance":"source"},{"stage":"secondary","techniques":["T1078","T1059"],"provenance":"source"}],"timeline":[{"date":"2023-10-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22515","provenance":"source"},{"date":"2023-10-04","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-10-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/atlassian_confluence_auth_bypass.rb","provenance":"source"},{"date":"2023-10-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html","provenance":"source"},{"date":"2023-10-05","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-10-05","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26655","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1123 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 25 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}