← gociux.comall exploited CVEs

Exploited vulnerability · CISA KEV

Is CVE-2022-26134 exploited? Yes: in CISA KEV since 2 Jun 2022

Gociux · Atlassian Confluence Server/Data Center · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2022-26134, Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 2 Jun 2022. It is known to be used in ransomware campaigns. It affects Atlassian Confluence Server/Data Center. If you run it, CISA's required action is: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

exploitedYesCISA KEV · 2 Jun 2022
ransomwareKnownused in campaigns
EPSStop 1%among the most likely CVEs to be exploited
severity9.8CVSS 3.1 · critical
US federal due6 Jun 2022BOD 22-01 deadline

What it is

Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.

VendorAtlassian (14 exploited CVEs in KEV)
ProductConfluence Server/Data Center
VulnerabilityAtlassian Confluence Server and Data Center Remote Code Execution Vulnerability
WeaknessCWE-917
Published3 Jun 2022
Added to KEV2 Jun 2022
Reported by (CNA)atlassian

What to do

  1. Check whether you run it. Look for Confluence Server/Data Center in your asset inventory, including appliances and cloud images. Stack check lists every exploited Atlassian CVE at once.
  2. Apply the fix. Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
  3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 3 Jun 2022.
  4. Get told next time. Email alerts when CISA adds a CVE for Atlassian.

References

Questions

Is CVE-2022-26134 being exploited?

Yes. CISA added CVE-2022-26134 to the Known Exploited Vulnerabilities catalog on 2 Jun 2022, which means there is reliable evidence of exploitation in the wild.

Is CVE-2022-26134 used in ransomware attacks?

Yes, CISA lists it as known to be used in ransomware campaigns.

How do I fix CVE-2022-26134?

Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules. Check Atlassian's advisory for the fixed versions, and if you can't patch quickly, restrict access to the affected Confluence Server/Data Center and watch it for signs of compromise.

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in June 2022 · Atlassian scorecard · act-now radar.

Running Atlassian in a regulated environment?

We check exposure across your estate, patch or mitigate with your team, and set up detection for what attackers do after exploiting it.

Get in touch →