CVE-2023-22518Active Exploitation(atlassian / confluence_data_center)

HIGHCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (4 mentions)

Immediate actions

Prioritize remediation for atlassian confluence_data_center systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

atlassian CVEs Back to dashboard

7.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-11-28. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518

Weakness type (CWE)

CWE-863

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

confluence_data_center
confluence_server

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
4 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 3 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
4 total mentions across 1 day

Affected systems

Vendors

atlassian

Products

confluence_data_centerconfluence_server

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 1d

Signal classification4 categories

Active Exploitation

125.0%

Disclosure

125.0%

Exploit

125.0%

PoC

125.0%

Referenced assets1 URL

By indicator

https://exploitgrid.net/exploits/ab157ce9-23e4-46ed-8dea-61c706a7434d

Full discourse4 posts

ExploitGrid@exploitgrid46d
Disclosure
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2023-22527 CVE-2023-22518 CVE-2023-46604 CVE-2024-25600 CVE-2023-41892 ..🧵👇
Post summary
The tweet announces the disclosure of several critical CVEs but provides no further technical details, exploitation information, or mitigation guidance.
1102042
38 followersView on X
ExploitGrid@exploitgrid46d
Exploit
[EXPLOIT] EGE-CX-58JHb10 [CRITICAL/PoC] Linked: CVE-2023-22518 Atlassian Confluence Improper Authorization / Code Execution 🔗 https://exploitgrid.net/exploits/ab157ce9-23e4-46ed-8dea-61c706a7434d
Post summary
A critical exploit for CVE‑2023‑22518 is posted, providing a PoC that demonstrates improper authorization leading to code execution on Atlassian Confluence; no patch or active exploitation details are included.
1001033
38 followersView on X
ExploitGrid@exploitgrid46d
PoC
[EXPLOIT] EGE-CX-58JHb10 [CRITICAL/PoC] Linked: CVE-2023-22518 Atlassian Confluence Improper Authorization / Code Execution 🔗 https://exploitgrid.net/exploits/ab157ce9-23e4-46ed-8dea-61c706a7434d
Post summary
The post announces a critical PoC for CVE‑2023‑22518 with Exploitgrid code available, highlighting an Atlassian Confluence improper authorization leading to code execution.
0000032
38 followersView on X
Vulnerability Research Labs@vulnresearchlab46d
Active Exploitation
An EPSS score of 0.99999 suggests active exploitation is a near certainty. We reproduced the public auth bypass in Atlassian Confluence, CVE-2023-22518. Total cost to build the exploit and verify the fix was $0.84.
Post summary
The text emphasizes a nearly certain active exploitation of CVE-2023-22518 in Atlassian Confluence, citing an EPSS score and a reproduced auth bypass, but lacks concrete patch or exploit tool details.
0000073
8 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	atlassian	confluence_data_center	-	-	-
App	atlassian	confluence_data_center	8.6.0	-	-
App	atlassian	confluence_server	-	-	-
App	atlassian	confluence_server	8.6.0	-	-

Explore more

Back to dashboard atlassian CVEs confluence_data_center vulnerabilities

What researchers are saying

CVE-2023-22518

ExploitGrid@exploitgridDisclosure

The tweet announces the disclosure of several critical CVEs but provides no further technical details, exploitation information, or mitigation guidance.

ExploitGrid@exploitgridExploit

A critical exploit for CVE‑2023‑22518 is posted, providing a PoC that demonstrates improper authorization leading to code execution on Atlassian Confluence; no patch or active exploitation details are included.

ExploitGrid@exploitgridPoC

The post announces a critical PoC for CVE‑2023‑22518 with Exploitgrid code available, highlighting an Atlassian Confluence improper authorization leading to code execution.

Vulnerability Research Labs@vulnresearchlabActive Exploitation

The text emphasizes a nearly certain active exploitation of CVE-2023-22518 in Atlassian Confluence, citing an EPSS score and a reproduced auth bypass, but lacks concrete patch or exploit tool details.