Exploited vulnerability · CISA KEV

Is CVE-2022-26138 exploited? Yes: in CISA KEV since 29 Jul 2022

Gociux · Atlassian Confluence · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2022-26138, Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 29 Jul 2022, 9 days after it was published. It affects Atlassian Confluence. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

What to do

1. Check whether you run it. Look for Confluence in your asset inventory, including appliances and cloud images. Stack check lists every exploited Atlassian CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 20 Jul 2022.
4. Get told next time. Email alerts when CISA adds a CVE for Atlassian.

References

• confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1
• nvd.nist.gov/vuln/detail/CVE-2022-26138

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in July 2022 · Atlassian scorecard · act-now radar.