CVE-2023-22526 Code injection in Confluence Data Center

High 7.2 Published 16 Jan 2024 Updated 20 Jun 2025

An authenticated attacker can execute arbitrary code on Confluence Data Center, compromising confidentiality, integrity, and availability.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-22526?

CVE-2023-22526 is a high-severity code injection vulnerability in Atlassian Confluence Data Center, published on 16 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 7.19: Upgrade to a release 7.19.17, or any higher 7.19.x release Confluence Data Center and Server 8.5: Upgrade to a release 8.5.5 or any higher 8.5.x release Confluence Data Center and Server 8.7: Upgrade to a release 8.7.2 or any higher release See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was discovered by m1sn0w and reported via our Bug Bounty program

Weakness: CWE-94

Which versions are affected by CVE-2023-22526?

It affects 2 products.

Products include Atlassian Confluence Data Center, Atlassian Confluence Server.

How do I fix CVE-2023-22526?

No fix has been published for CVE-2023-22526 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-22526 being exploited?

There is no known exploitation of CVE-2023-22526 in the wild and no public exploit code.

Sources

Also known as GHSA-f9mv-753f-hvx4.