What happened
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
Affected versions
Confluence Server/Data Center: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 50952Confluence Data Center 7.18.0 - Remote Code Execution (RCE)Fellipe Oliveira2022-06-10VerifiedSploitusExploit for CVE-2022-26134. CVSS 9.8.Sploitus index2026-10-14T05:01:08+00:00CandidatePoC-in-GitHub · W01fh4cker/Serein【懒人神器】一款图形化、批量采集url、批量对采集的url进行各种nday检测的工具。可用于src挖掘、cnvd挖掘、0day利用、打造自己的武器库等场景。可以批量利用Actively Exploited Atlassian Confluence 0Day CVE-2022-26134和DedeCMS v5.7.87 SQL注入 CVE-2022-23337。★ 1247W01fh4cker2022-05-31CandidatePoC-in-GitHub · offlinehoster/CVE-2022-26134Information and scripts for the confluence CVE-2022-26134★ 8offlinehoster2022-06-03CandidatePoC-in-GitHub · ma1am/CVE-2022-26134-Exploit-DetectionThis repository contains Yara rule and the method that a security investigator may want to use for CVE-2022-26134 threat hunting on their Linux confluence servers.★ 1ma1am2022-06-03CandidatePoC-in-GitHub · jbaines-r7/through_the_wireCVE-2022-26134 Proof of Concept★ 174jbaines-r72022-06-03CandidatePoC-in-GitHub · crowsec-edtech/CVE-2022-26134CVE-2022-26134 - Confluence Pre-Auth RCE | OGNL injection★ 31crowsec-edtech2022-06-03CandidatePoC-in-GitHub · kyxiaxiang/CVE-2022-26134★ 3kyxiaxiang2022-06-04CandidatePoC-in-GitHub · Brucetg/CVE-2022-26134（CVE-2022-26134）an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server★ 2Brucetg2022-06-04CandidatePoC-in-GitHub · shamo0/CVE-2022-26134Confluence Server and Data Center - CVE-2022-26134 - Critical severity unauthenticated remote code execution vulnerability PoC★ 1shamo02022-06-04CandidatePoC-in-GitHub · SNCKER/CVE-2022-26134[CVE-2022-26134]Confluence OGNL expression injected RCE with sandbox bypass.★ 26SNCKER2022-06-04CandidatePoC-in-GitHub · Vulnmachines/Confluence-CVE-2022-26134★ 3Vulnmachines2022-06-05CandidatePoC-in-GitHub · axingde/CVE-2022-26134Atlassian confluence poc★ 1axingde2022-06-05CandidatePoC-in-GitHub · 0xAgun/CVE-2022-26134★ 10xAgun2022-06-05CandidatePoC-in-GitHub · abhishekmorla/CVE-2022-26134★ 8abhishekmorla2022-06-05CandidatePoC-in-GitHub · hev0x/CVE-2022-26134Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134)★ 44hev0x2022-06-06CandidatePoC-in-GitHub · archanchoudhury/Confluence-CVE-2022-26134This repository talks about Zero-Day Exploitation of Atlassian Confluence, it's defense and analysis point of view from a SecOps or Blue Team perspective★ 4archanchoudhury2022-06-06CandidatePoC-in-GitHub · SIFalcon/confluencePotSimple Honeypot for Atlassian Confluence (CVE-2022-26134)★ 20SIFalcon2022-06-06CandidatePoC-in-GitHub · vesperp/CVE-2022-26134-Confluence★ 0vesperp2022-06-07CandidatePoC-in-GitHub · li8u99/CVE-2022-26134Atlassian Confluence 远程代码执行漏洞（CVE-2022-26134）★ 4li8u992022-06-07CandidatePoC-in-GitHub · reubensammut/cve-2022-26134Implementation of CVE-2022-26134★ 1reubensammut2022-06-07CandidatePoC-in-GitHub · BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL★ 339BeichenDream2022-06-07CandidatePoC-in-GitHub · alcaparra/CVE-2022-26134CVE-2022-26134 Confluence OGNL Injection POC★ 4alcaparra2022-06-07CandidatePoC-in-GitHub · whokilleddb/CVE-2022-26134-Confluence-RCEExploit for CVE-2022-26134: Confluence Pre-Auth Remote Code Execution via OGNL Injection★ 13whokilleddb2022-06-07CandidatePoC-in-GitHub · Habib0x0/CVE-2022-26134Atlassian Confluence- Unauthenticated OGNL injection vulnerability (RCE)★ 1Habib0x02022-06-07CandidatePoC-in-GitHub · Y000o/Confluence-CVE-2022-26134★ 4Y000o2022-06-07CandidatePoC-in-GitHub · redhuntlabs/ConfluentPwnAtlassian confluence unauthenticated ONGL injection remote code execution scanner (CVE-2022-26134).★ 12redhuntlabs2022-06-08CandidatePoC-in-GitHub · secjia/CVE-2022-26134★ 0secjia2022-06-08CandidatePoC-in-GitHub · cai-niao98/CVE-2022-26134CVE-2022-26134★ 3cai-niao982022-06-09CandidatePoC-in-GitHub · sunny-kathuria/exploit_CVE-2022-26134CVE-2022-26134, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. This is CVE-2022-26134 expoitation script★ 0sunny-kathuria2022-06-10CandidatePoC-in-GitHub · KeepWannabe/BotCon[CVE-2022-26134] Attlasian Confluence RCE★ 3KeepWannabe2022-06-10CandidatePoC-in-GitHub · Chocapikk/CVE-2022-26134CVE-2022-26134 - Pre-Auth Remote Code Execution via OGNL Injection★ 4Chocapikk2022-06-13CandidatePoC-in-GitHub · AmoloHT/CVE-2022-26134「💥」CVE-2022-26134 - Confluence Pre-Auth RCE★ 14AmoloHT2022-06-19CandidatePoC-in-GitHub · kh4sh3i/CVE-2022-26134[PoC] Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE)★ 4kh4sh3i2022-06-21CandidatePoC-in-GitHub · ColdFusionX/CVE-2022-26134Atlassian Confluence OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2022-26134)★ 2ColdFusionX2022-06-24CandidatePoC-in-GitHub · Luchoane/CVE-2022-26134_conFLUPoC for exploiting CVE-2022-26134 on Confluence★ 0Luchoane2022-06-29CandidatePoC-in-GitHub · r1skkam/TryHackMe-Atlassian-CVE-2022-26134Atlassian, CVE-2022-26134 An interactive lab showcasing the Confluence Server and Data Center un-authenticated RCE vulnerability.★ 1r1skkam2022-07-04CandidatePoC-in-GitHub · nxtexploit/CVE-2022-26134Atlassian Confluence (CVE-2022-26134) - Unauthenticated Remote code execution (RCE)★ 29nxtexploit2022-07-05CandidatePoC-in-GitHub · Debajyoti0-0/CVE-2022-26134Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE).★ 4Debajyoti0-02022-07-05CandidatePoC-in-GitHub · f4yd4-s3c/cve-2022-26134★ 2f4yd4-s3c2022-07-06CandidatePoC-in-GitHub · coskper-papa/CVE-2022-26134confluence rce★ 1coskper-papa2022-07-08CandidatePoC-in-GitHub · p4b3l1t0/confusploitThis is a python script that can be used with Shodan CLI to mass hunting Confluence Servers vulnerable to CVE-2022-26134★ 2p4b3l1t02022-07-12CandidatePoC-in-GitHub · twoning/CVE-2022-26134-PoCCVE-2022-26134-PoC★ 2twoning2022-07-14CandidatePoC-in-GitHub · iveresk/cve-2022-26134Just simple PoC for the Atlassian Jira exploit. Provides code execution for unauthorised user on a server.★ 12iveresk2022-07-15CandidatePoC-in-GitHub · keven1z/CVE-2022-26134远程攻击者在Confluence未经身份验证的情况下，可构造OGNL表达式进行注入，实现在Confluence Server或Data Center上执行任意代码,在现有脚本上修改了poc，方便getshell。★ 7keven1z2022-07-23CandidatePoC-in-GitHub · shiftsansan/CVE-2022-26134-ConsoleCVE-2022-26134-Console★ 0shiftsansan2022-08-22CandidatePoC-in-GitHub · 1337in/CVE-2022-26134webCVE-2022-26134 web payload★ 11337in2022-08-26CandidatePoC-in-GitHub · skhalsa-sigsci/CVE-2022-26134-LABDetecting CVE-2022-26134 using Nuclei★ 3skhalsa-sigsci2022-10-09CandidatePoC-in-GitHub · yigexioabai/CVE-2022-26134-cve1★ 0yigexioabai2022-10-15CandidatePoC-in-GitHub · kailing0220/CVE-2022-26134在受影响的Confluence Server 和Data Center 版本中，存在一个OGNL 注入漏洞，该漏洞允许未经身份验证的攻击者在Confluence Server 或Data Center 服务器上执行任意代码。★ 1kailing02202022-10-15CandidatePoC-in-GitHub · xanszZZ/ATLASSIAN-Confluence_rce批量检测CVE-2022-26134 RCE漏洞★ 0xanszZZ2022-10-16CandidatePoC-in-GitHub · kelemaoya/CVE-2022-26134Confluence Server and Data Center存在一个远程代码执行漏洞，未经身份验证的攻击者可以利用该漏洞向目标服务器注入恶意ONGL表达式，进而在目标服务器上执行任意代码。★ 1kelemaoya2022-10-16CandidatePoC-in-GitHub · CJ-0107/cve-2022-26134cve-2022-26134★ 1CJ-01072022-10-16CandidatePoC-in-GitHub · latings/CVE-2022-26134CVE-2022-26134★ 0latings2022-10-16CandidatePoC-in-GitHub · yyqxi/CVE-2022-26134CVE-2022-26134poc★ 0yyqxi2022-10-16CandidatePoC-in-GitHub · b4dboy17/CVE-2022-26134★ 2b4dboy172022-10-24CandidatePoC-in-GitHub · wjlin0/CVE-2022-26134CVE-2022-26134 GO POC 练习★ 0wjlin02022-12-25CandidatePoC-in-GitHub · cbk914/CVE-2022-26134_check★ 3cbk9142023-01-15CandidatePoC-in-GitHub · MaskCyberSecurityTeam/CVE-2022-26134_Behinder_MemShell★ 8MaskCyberSecurityTeam2023-02-04CandidatePoC-in-GitHub · Muhammad-Ali007/Atlassian_CVE-2022-26134Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134)★ 0Muhammad-Ali0072023-07-30CandidatePoC-in-GitHub · acfirthh/CVE-2022-26134A PoC for CVE-2022-26134 for Educational Purposes and Security Research★ 1acfirthh2023-09-20CandidatePoC-in-GitHub · yTxZx/CVE-2022-26134★ 0yTxZx2023-10-20CandidatePoC-in-GitHub · DARKSTUFF-LAB/-CVE-2022-26134★ 0DARKSTUFF-LAB2023-12-29CandidatePoC-in-GitHub · 404fu/CVE-2022-26134-POC★ 1404fu2024-03-26CandidatePoC-in-GitHub · xsxtw/CVE-2022-26134★ 0xsxtw2024-05-02CandidatePoC-in-GitHub · BBD-YZZ/Confluence-RCEconfluence rce (CVE-2021-26084, CVE-2022-26134, CVE-2023-22527)★ 5BBD-YZZ2024-05-29CandidatePoC-in-GitHub · cc3305/CVE-2022-26134CVE-2022-26134 exploit script★ 0cc33052024-06-07CandidatePoC-in-GitHub · Gilospy/CVE-2022-26134★ 0Gilospy2024-10-13CandidatePoC-in-GitHub · Khalidhaimur/CVE-2022-26134Active Exploitation of Atlassian’s Questions for Confluence App CVE-2022-26134★ 0Khalidhaimur2025-02-12CandidatePoC-in-GitHub · tpdlshdmlrkfmcla/cve-2022-26134cve-2022-26134 atlassia Confluence Data Center2016 server OGNL %[...}★ 0tpdlshdmlrkfmcla2025-03-30CandidatePoC-in-GitHub · thetowsif/CVE-2022-26134Atlassian's Confluence Server and Data Center editions (Vulnerable Version > 7.18.1)★ 0thetowsif2025-06-09CandidatePoC-in-GitHub · MAHABUB122003/Atlassian-CVE-2022-26134★ 0MAHABUB1220032025-06-14CandidatePoC-in-GitHub · crypt0lith/confluence-ognl-rceConfluence Unauth RCE (CVE-2022-26134)★ 0crypt0lith2026-02-26CandidatePoC-in-GitHub · roodhelios/CVE-2022-26134-OGNL-Injection★ 0roodhelios2026-05-06CandidateSploitusProof-of-concept exploit for CVE-2022-26134 and CVE-2022-26136. CVSS 10.Sploitus index2026-10-20T18:03:47+00:00CandidateSource timeline
Discovered through CISA Known Exploited VulnerabilitiesView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.