Atlassian Confluence Data Center and Server Broken Access Control Vulnerability (CVE-2023-22515)

Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.

Published Oct 4, 2023 · Updated May 29, 2026

X LinkedIn

Why patchRisk explained in plain English

Worst-case scenarioIf unpatched

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. CISA has confirmed use of this vulnerability in known ransomware campaigns — treat as high priority for remediation. Federal agencies are required to remediate by 2023-10-13 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Improper Input Validation (CWE-20) vulnerability in Atlassian Confluence Data Center and Server. Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●IT Security

●Running confluence data center: 8.0.0 ≤ v < 8.3.3, 8.4.0 ≤ v < 8.4.3, 8.5.0 ≤ v < 8.5.2; confluence server: 8.0.0 ≤ v < 8.3.3, 8.4.0 ≤ v < 8.4.3, 8.5.0 ≤ v < 8.5.2

Real-world incidentsWhat we've seen

Used in known ransomware campaigns. Threat-research write-up: http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html

How to patch

Get the fix

Apply the fixed package from your vendor. The advisory lists affected versions and the exact fixed build.

↗ Vendor advisory

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.

References

Vendor advisory: https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html

NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-22515

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2023-22515 ↗ Advisory