{"slug":"confluence-ssti","title":"Confluence SSTI RCE (CVE-2023-22527)","shortName":"Confluence SSTI","summary":"Unauthenticated OGNL injection in out-of-date Confluence Data Center and Server 8.x (through 8.5.3) enabling remote code execution. Atlassian CVSS 10.0; NVD 9.8. Mass exploitation attempts from 19 Jan 2024 (Shadowserver). CISA KEV 24 Jan 2024; ransomware Known.","isExample":false,"draft":false,"family":"confluence-ssti","kind":"single-product","aliases":["CVE-2023-22527","Confluence OGNL","Confluence SSTI"],"publishedAt":"2024-01-16","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2023-22527","cvss":{"cve":"CVE-2023-22527","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-22527","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2023-22527","score":0.99984,"percentile":0.99983,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-22527","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2023-22527","listed":true,"dateAdded":"2024-01-24","dueDate":"2024-02-14","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated OGNL injection remote code execution on out-of-date Confluence Data Center and Server 8.x (CVE-2023-22527). Atlassian CVSS 10.0; NVD 9.8. Mass attempts from 19 Jan 2024. Listed in CISA KEV; ransomware Known.","action":"Confirm Data Center and Server 8.x instances are on 8.5.4 or later (or 8.6.0 / 8.7.1 on Data Center) and hunt access logs for text-inline.vm. Cloud and 7.19 LTS are not affected per Atlassian."},"seenInTheWild":[{"metric":"scanning","value":"about 39,048 events from 602 IPs","observer":"Shadowserver","date":"2024-01-22","method":"Shadowserver reported attempts since 19 Jan 2024, via SC Media. Includes callback tests and whoami.","sourceUrl":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce"},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2024-01-24","method":"CISA Known Exploited Vulnerabilities catalog dateAdded. knownRansomwareCampaignUse Known.","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-24","items":[{"text":"Page added","section":"overview"},{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2023-22527 is an unauthenticated OGNL injection in older Confluence Data Center and Server 8.x releases that allows remote code execution. Atlassian rates it CVSS 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). NVD rates CVSS 3.1 9.8. Affected versions are 8.0.x through 8.4.x and 8.5.0 through 8.5.3. Confluence 7.19.x LTS and Atlassian Cloud are not affected per Atlassian. There is no workaround; Atlassian requires an upgrade.\n\nPreconditions: Confluence Data Center or Server on an affected 8.x build, with network reachability to the HTTP(S) interface, often port 8090 in docs and public modules. No authentication is required.\n\nProjectDiscovery (22 Jan 2024) showed the practical path uses an unauthenticated Velocity view named text-inline.vm, where the label parameter reaches OGNL evaluation. Advisory fixed versions include 8.5.4 (LTS), 8.6.0, and 8.7.1 (Data Center only). Atlassian also pointed at 8.5.5 and 8.7.2 as current releases at advisory time.\n\nShadowserver observed exploit attempts from 19 Jan 2024, days after the 16 Jan advisory. Follow-on abuse has included cryptomining (Trend Micro, 28 Aug 2024). CISA KEV lists known ransomware campaign use. This page does not name a ransomware affiliate; no primary affiliate report was in the sources reviewed here.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Confluence reachability","detail":"Unauthenticated HTTP(S) access to an affected Confluence Data Center or Server 8.x instance."},{"id":"unsafe","label":"OGNL injection","detail":"Attacker reaches a Velocity view that evaluates attacker-controlled OGNL. Public analyses name text-inline.vm."},{"id":"exec","label":"Code / command exec","detail":"Arbitrary code or OS commands run in the Confluence process context. Conceptual only."},{"id":"persist","label":"Mining / ransomware / lateral","detail":"Observed follow-on includes cryptominers and other post-exploitation. Ransomware use is flagged in KEV without a named affiliate here."}]},"exploitation":{"kev":{"listed":true,"date":"2024-01-24","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV CVE-2023-22527 Atlassian Confluence Data Center and Server. dateAdded 2024-01-24, due 2024-02-14. knownRansomwareCampaignUse Known."},"firstSeen":{"date":"2024-01-19","source":"Shadowserver (via SC Media)","note":"Shadowserver reported seeing pre-auth RCE attempts since 19 Jan 2024. By 22 Jan 2024, about 39,048 events from 602 unique IPs (callback tests and whoami)."},"vendorStatements":[{"vendor":"Atlassian","date":"2024-01-16","statement":"An unauthenticated attacker can achieve remote code execution on out-of-date Confluence Data Center and Server versions. Customers using an affected version must take immediate action. There are no known workarounds. 7.19.x LTS versions are not affected. Atlassian Cloud sites are not affected.","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","retracted":false}]},"timeline":[{"date":"2024-01-16","event":"Atlassian publishes the CVE-2023-22527 advisory. Affected: 8.0.x through 8.5.3. Fixed: 8.5.4, 8.6.0, 8.7.1. 7.19.x LTS and Cloud are not affected. Discovered by Petrus Viet via bug bounty.","source":{"title":"Atlassian CVE-2023-22527 advisory","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","publisher":"Atlassian"},"kind":"advisory","key":true,"addedDate":"2026-10-24"},{"date":"2024-01-19","event":"Shadowserver later reports seeing exploit attempts from this date.","source":{"title":"Thousands of exploit attempts reported on critical Atlassian Confluence RCE","url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","publisher":"SC Media"},"kind":"exploited","key":true,"addedDate":"2026-10-24"},{"date":"2024-01-22","event":"ProjectDiscovery publishes analysis of the unauthenticated Velocity path (text-inline.vm, label parameter) and a nuclei check.","source":{"title":"Atlassian Confluence SSTI Remote Code Execution","url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","publisher":"ProjectDiscovery"},"kind":"poc","key":true,"addedDate":"2026-10-24"},{"date":"2024-01-22","event":"SC Media reports Shadowserver seeing about 39,048 events from 602 IPs by this date.","source":{"title":"Thousands of exploit attempts reported on critical Atlassian Confluence RCE","url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","publisher":"SC Media"},"kind":"exploited","key":true,"addedDate":"2026-10-24"},{"date":"2024-01-24","event":"CISA adds CVE-2023-22527 to KEV (due 14 Feb 2024). knownRansomwareCampaignUse Known.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-24"},{"date":"2024-08-28","event":"Trend Micro publishes research on cryptojacking campaigns abusing CVE-2023-22527 (XMRig, cron persistence, SSH spread).","source":{"title":"Cryptojacking via CVE-2023-22527","url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","publisher":"Trend Micro"},"kind":"other","addedDate":"2026-10-24"}],"openNotes":[{"title":"No public live tracker located for CVE-2023-22527","detail":"Checked 24 Oct 2026. The Shadowserver http_vulnerable dashboard with tag cve-2023-22527 (same URL pattern as other catalog pages) returned that the tag is not one of the available choices. GreyNoise tag and CVE pages returned 403. seenInTheWildLinks stays empty.","sources":[{"url":"https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2023-22527&dataset=unique_ips&style=stacked","date":"2026-10-24","publisher":"Shadowserver"}]},{"title":"No named ransomware affiliate in the sources reviewed","detail":"CISA KEV lists known ransomware campaign use. This page does not name an affiliate because no primary affiliate report was in the pack sources.","sources":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-24","publisher":"CISA"}]}],"defenderActions":[{"title":"Upgrade Confluence to a fixed release","detail":"Move affected 8.x instances to at least 8.5.4, or to 8.6.0 / 8.7.1 on Data Center, or a current supported release. No workaround. Cloud and 7.19 LTS are not affected per Atlassian.","priority":"now","links":[{"label":"Atlassian CVE-2023-22527","href":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html"}]},{"title":"Retrohunt access logs for text-inline.vm","detail":"Search for POSTs to the unauthenticated Velocity path ProjectDiscovery names (text-inline.vm) from 16 Jan 2024 onward (disclosure; Shadowserver attempts from 19 Jan 2024), or earlier if the instance was exposed.","priority":"now"},{"title":"Host hunt for mining and webshell follow-on","detail":"Check for unexpected child processes from the Confluence JVM, new cron jobs, disabled security tools, and outbound mining-pool traffic (Trend Micro cryptojacking reporting).","priority":"soon","links":[{"label":"Trend Micro cryptomining research","href":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html"}]}],"detection":[{"title":"POST to text-inline.vm","detail":"ProjectDiscovery and the Metasploit module document this unauthenticated Velocity path as the practical injection point. Alert on POSTs with unusual label parameters.","logSource":"Confluence/Catalina or reverse-proxy access logs","kind":"generic","group":"web-proxy"},{"title":"Nuclei CVE-2023-22527 (OAST)","detail":"ProjectDiscovery published a nuclei check that uses an out-of-band callback rather than dropping a shell.","logSource":"Vulnerability scanner","kind":"generic"},{"title":"Suspicious child processes of Confluence","detail":"whoami, curl, wget, bash, and cryptominer binaries spawned by the Java process. Shadowserver early attempts included whoami. Trend Micro describes mining follow-on.","logSource":"EDR / auditd","kind":"generic","group":"edr"}],"detectionRules":[{"id":"splunk-confluence-pre-auth-rce-cve-2023-22527","title":"Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527","language":"spl","query":"| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web\n  WHERE Web.url=\"*/template/aui/text-inline.vm*\" Web.http_method=POST Web.status IN (200, 202)\n  BY Web.src, Web.dest, Web.http_user_agent,\n     Web.url, Web.status\n| `drop_dm_object_name(\"Web\")`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter`","logSource":"Web datamodel (Suricata or equivalent HTTP logs)","author":"Michael Haag, Splunk","authorUrl":"https://github.com/splunk/security_content","sourceUrl":"https://github.com/splunk/security_content/blob/db8c7c8509b55374a324b6dc57a3f325e8685736/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Splunk security_content production rule. creation_date 2024-01-24. This site does not republish exploit payloads.","tested":"tested","testedNote":"Source lists a True Positive Test with published Suricata attack_data.","testedSourceUrl":"https://github.com/splunk/security_content/blob/db8c7c8509b55374a324b6dc57a3f325e8685736/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml"}],"detectionLinks":[{"title":"Atlassian CVE-2023-22527 advisory","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","author":"Atlassian","date":"2024-01-16"},{"title":"ProjectDiscovery analysis and nuclei check","url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","author":"Rahul Maini and Harsh Jaiswal (ProjectDiscovery)","date":"2024-01-22"}],"retrohunt":{"summary":"Search Confluence and reverse-proxy access logs from 16 Jan 2024 (attempts from 19 Jan per Shadowserver) for POSTs to text-inline.vm, then hunt the host for unexpected child processes, cron jobs, and mining follow-on.","lookback":{"from":"2024-01-16","basis":"public-disclosure","rationale":"Atlassian disclosed on 16 Jan 2024. Shadowserver saw attempts from 19 Jan 2024. For internet-facing instances that were on 8.0 through 8.5.3, hunt from first exposure or at least from disclosure through patch date. Keep access logs covering Velocity .vm paths.","sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"},{"url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","publisher":"SC Media"}]},"logSources":[{"name":"Confluence / Catalina access logs","why":"Show POSTs to text-inline.vm and other unexpected .vm hits.","required":true},{"name":"Reverse-proxy access logs in front of Confluence","why":"Same URI if Catalina logs were rotated away.","required":true},{"name":"Host EDR / auditd on the Confluence node","why":"Child processes (whoami, curl, wget, miners, ssh) from the JVM.","required":false},{"name":"Filesystem, cron, and egress DNS / firewall","why":"Trend Micro describes planted files, cron persistence, and mining-pool egress.","required":false}],"steps":[{"title":"Search access logs for text-inline.vm","detail":"ProjectDiscovery and the Metasploit module name POST to text-inline.vm with a label parameter as the practical injection point.","sources":[{"url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","date":"2024-01-22","publisher":"ProjectDiscovery"}]},{"title":"Hunt child processes of the Confluence JVM","detail":"Shadowserver early attempts included whoami. Trend Micro describes curl/wget, miners, and SSH spread.","sources":[{"url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","publisher":"SC Media"},{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"}]},{"title":"Check cron, home, and webapps for unexpected files","detail":"Trend Micro describes new cron jobs, disabled security tools, and planted scripts used for cryptomining.","sources":[{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"}]}],"queries":[{"id":"v2s-rh-spl-confluence-text-inline","title":"POSTs to text-inline.vm since 16 Jan 2024","language":"spl","query":"index=* earliest=\"01/16/2024:00:00:00\" (sourcetype=access_combined OR sourcetype=tomcat OR sourcetype=nginx OR sourcetype=iis)\n(\"/template/aui/text-inline.vm\" OR \"text-inline.vm\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(method) as method values(status) as status by src_ip, dest, uri_path\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Confluence/Catalina or reverse-proxy access logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","sourceDate":"2024-01-22","license":"CC0 1.0","origin":"vuln2shell","notes":"URI from ProjectDiscovery. Confirm the sourcetype your proxy or Tomcat add-on uses.","tested":"untested","timeRange":"From 2024-01-16, limited by retention"},{"id":"v2s-rh-kql-confluence-text-inline","title":"POSTs to text-inline.vm since 16 Jan 2024","language":"kql","query":"union isfuzzy=true CommonSecurityLog, W3CIISLog\n| where TimeGenerated >= datetime(2024-01-16)\n| where RequestURL has \"text-inline.vm\" or RequestURI has \"text-inline.vm\" or csUriStem has \"text-inline.vm\" or AdditionalExtensions has \"text-inline.vm\"\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName, RequestMethod","logSource":"Reverse-proxy or IIS/CEF access logs in Microsoft Sentinel","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","sourceDate":"2024-01-22","license":"CC0 1.0","origin":"vuln2shell","notes":"Field names vary by connector. The URI token is text-inline.vm.","tested":"untested","timeRange":"From 2024-01-16, limited by retention"},{"id":"v2s-rh-logscale-confluence-text-inline","title":"POSTs to text-inline.vm","language":"logscale","query":"// Set the time picker to start 2024-01-16\n/text-inline\\.vm/\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"Confluence or reverse-proxy access logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","sourceDate":"2024-01-22","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2024-01-16"}],"thirdPartyQueries":[{"title":"ProjectDiscovery analysis (includes the nuclei check)","url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","author":"Rahul Maini, Harsh Jaiswal","date":"2024-01-22","language":"guide","license":"public","origin":"community","note":"OAST-style check. Do not treat a callback as a shell drop."},{"title":"Trend Micro cryptojacking write-up","url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","author":"Abdelrahman Esmail (Trend Micro)","date":"2024-08-28","language":"guide","license":"public","origin":"vendor","note":"Host and cron hunting patterns for mining follow-on. Specific hashes from that post are not copied here."}],"artefacts":[{"kind":"web-log","value":"POST to text-inline.vm with an unusual label parameter","detail":"Practical injection point named by ProjectDiscovery.","sourceUrl":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","sourceDate":"2024-01-22"},{"kind":"process","value":"whoami / curl / wget / miner binaries spawned by the Confluence JVM","detail":"Shadowserver early attempts included whoami. Trend Micro describes mining follow-on.","sourceUrl":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","sourceDate":"2024-01-22"},{"kind":"file","value":"Unexpected cron jobs or scripts under Confluence home, webapps, or temp","detail":"Trend Micro cryptomining persistence pattern.","sourceUrl":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","sourceDate":"2024-08-28"}],"iocNote":"Trend Micro published campaign indicators in its 28 Aug 2024 post. Specific hashes and wallets from that post are not copied here.","hitMeaning":[{"level":"attempt","detail":"A POST to text-inline.vm with no follow-on process or file change."},{"level":"likely-compromise","detail":"whoami, curl, wget, or similar spawned by the Confluence JVM after such a POST."},{"level":"confirmed-compromise","detail":"A miner, webshell, or cron persistence matching Trend Micro's follow-on patterns."}],"nextSteps":[{"title":"Upgrade and keep the host hunt going","detail":"Install a fixed release. A successful RCE can leave miners and cron jobs after the upgrade.","links":[{"label":"Atlassian advisory","href":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html"}]},{"title":"Rotate secrets on the host","detail":"Assume wiki content, local credentials, and SSH keys on a compromised host are exposed."}],"limits":["Cloud and 7.19 LTS are not affected per Atlassian, so those instances are out of scope for this hunt.","Specific Trend Micro hashes and wallets are not copied here.","Instances that never shipped access logs off-box have no history after rotation."],"sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"},{"url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","date":"2024-01-22","publisher":"ProjectDiscovery"},{"url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","publisher":"SC Media"},{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"Confluence Data Center and Server 8.0.x through 8.4.x and 8.5.0 through 8.5.3 are in scope until 8.5.4, 8.6.0, or 8.7.1. Atlassian states 7.19.x LTS and Atlassian Cloud are not affected. There is no workaround.","checks":[{"id":"v2s-aia-confluence-ssti-version-1","kind":"version","title":"Read the Confluence Data Center or Server version","detail":"Atlassian (16 Jan 2024): affected 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0 through 8.5.3. Fixed: 8.5.4 (LTS), 8.6.0, 8.7.1 (Data Center only). Latest pointed at advisory time also included 8.5.5 and 8.7.2. 7.19.x LTS is not affected. Record the version from the About Confluence page or the Administration version string. No public CLI version string was copied from the advisory in this pass.","command":"On the About Confluence page or in Administration, record the Data Center or Server version string and compare it to 8.5.4 / 8.6.0 / 8.7.1.","affectedMeans":"Data Center or Server 8.0.x through 8.4.x, or 8.5.0 through 8.5.3.","fixedMeans":"8.5.4 or later on the 8.5 train, 8.6.0 or later, or 8.7.1 or later on Data Center. 7.19.x LTS and Atlassian Cloud are vendor-stated not affected.","sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22527","date":"2024-01-16","publisher":"NVD"}]},{"id":"v2s-aia-confluence-ssti-config-2","kind":"config","title":"Confirm the site is Data Center or Server, not Cloud","detail":"Atlassian: Atlassian Cloud sites are not affected. If the site is reached at an atlassian.net hostname, it is hosted by Atlassian. This page is about customer-managed Data Center and Server.","command":"Record the site hostname and product edition. If the hostname ends in atlassian.net, treat it as Atlassian Cloud (vendor-stated not affected). Otherwise record Data Center or Server and complete the version check.","affectedMeans":"A customer-managed Data Center or Server host on 8.0 through 8.5.3.","fixedMeans":"Atlassian Cloud (atlassian.net), 7.19.x LTS, or a fixed 8.x release.","sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"}]}],"limits":["Cloud and 7.19 LTS are vendor-stated not affected. Do not mark them affected.","Atlassian publishes no workaround. A patched host can still hold miners or cron jobs (Trend Micro, 28 Aug 2024).","No sourced Shodan product query is published on this page; do not invent one."],"sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22527","date":"2024-01-16","publisher":"NVD"},{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Atlassian says there are no known workarounds and customers on an affected version must update. CISA KEV tells you to apply vendor instructions or discontinue use.","items":[],"nonePublished":{"statement":"No vendor mitigation published; patch is the only fix","checkedDate":"2026-10-24","sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-24","publisher":"CISA"}]},"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Upgrade affected 8.x instances immediately. Atlassian requires an update; CISA KEV due 14 Feb 2024. Hunt access logs for POSTs to text-inline.vm and the host for mining or cron follow-on.","containment":[{"title":"Upgrade Confluence to a fixed release","detail":"Atlassian (16 Jan 2024): customers using an affected version must take immediate action. Fixed: 8.5.4 (LTS), 8.6.0, 8.7.1 (Data Center only). CISA KEV due 14 Feb 2024: apply vendor instructions or discontinue use if mitigations are unavailable. There are no known workarounds.","sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-24","publisher":"CISA"}]},{"title":"Hunt access logs for POSTs to text-inline.vm","detail":"ProjectDiscovery (22 Jan 2024) names the unauthenticated Velocity view text-inline.vm as the practical injection point. Shadowserver, via SC Media, reported attempts from 19 Jan 2024.","sources":[{"url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","date":"2024-01-22","publisher":"ProjectDiscovery"},{"url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","publisher":"SC Media"}]},{"title":"Hunt the host for mining and cron follow-on","detail":"Trend Micro (28 Aug 2024) describes cryptojacking campaigns: unexpected child processes from the Confluence JVM, new cron jobs, disabled security tools, and outbound mining-pool traffic. Shadowserver early attempts included whoami.","sources":[{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"},{"url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","publisher":"SC Media"}]},{"title":"Take an internet-facing affected instance off untrusted networks if you cannot upgrade yet","detail":"Atlassian requires immediate action and publishes no workaround. Isolation is a generic control until 8.5.4 / 8.6.0 / 8.7.1 is installed. It does not remove miners or cron already planted.","generic":true,"sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"}]}],"rotate":[{"item":"Local Confluence accounts, session tokens, and SSH keys on the host","reason":"Unauthenticated RCE runs in the Confluence process context. Trend Micro describes SSH spread after compromise. Assume wiki content and host credentials are exposed if a miner, cron job, or unexpected JVM child process is found.","sources":[{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"}]}],"persistence":[{"kind":"cron","value":"Unexpected cron jobs or scripts under Confluence home, webapps, or temp","detail":"Trend Micro cryptomining persistence pattern (28 Aug 2024). Specific hashes and wallets from that post are not copied here.","sourceUrl":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","sourceDate":"2024-08-28"}],"evidence":[{"title":"Keep Confluence and reverse-proxy access logs from 16 Jan 2024","detail":"Search for POSTs to text-inline.vm. ProjectDiscovery documents this path. Shadowserver saw attempts from 19 Jan 2024.","sources":[{"url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","date":"2024-01-22","publisher":"ProjectDiscovery"},{"url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","publisher":"SC Media"}]},{"title":"Keep host process, cron, and egress records","detail":"Trend Micro describes curl/wget, miners, disabled security tools, and mining-pool egress from the Confluence JVM.","sources":[{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"}]}],"limits":["Cloud and 7.19 LTS are not affected per Atlassian, so those instances are out of scope.","Specific Trend Micro hashes and wallets are not copied here.","Instances that never shipped access logs off-box have no history after rotation."],"sources":[{"url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","publisher":"Atlassian"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-24","publisher":"CISA"},{"url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","date":"2024-01-22","publisher":"ProjectDiscovery"},{"url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","publisher":"SC Media"},{"url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","publisher":"Trend Micro"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Atlassian","title":"CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","cve":"CVE-2023-22527"}],"coverage":[{"title":"Atlassian CVE-2023-22527 advisory","publisher":"Atlassian","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","date":"2024-01-16","type":"vendor","addedDate":"2026-10-24"},{"title":"ProjectDiscovery analysis","publisher":"ProjectDiscovery","url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","date":"2024-01-22","type":"research","addedDate":"2026-10-24"},{"title":"Thousands of exploit attempts reported on critical Atlassian Confluence RCE","publisher":"SC Media","url":"https://www.scworld.com/news/thousands-of-exploit-attempts-reported-on-critical-atlassian-confluence-rce","date":"2024-01-22","type":"news","addedDate":"2026-10-24"},{"title":"CISA KEV entry for CVE-2023-22527","publisher":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527","date":"2024-01-24","type":"government","addedDate":"2026-10-24"},{"title":"Cryptojacking via CVE-2023-22527","publisher":"Trend Micro","url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","date":"2024-08-28","type":"research","addedDate":"2026-10-24"}],"posts":[],"research":[{"title":"Atlassian CVE-2023-22527 advisory","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","authors":"Atlassian (discovered by Petrus Viet via bug bounty)","date":"2024-01-16"},{"title":"ProjectDiscovery SSTI analysis","url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","authors":"Rahul Maini, Harsh Jaiswal (ProjectDiscovery)","date":"2024-01-22"},{"title":"NVD CVE-2023-22527","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22527","authors":"NVD","date":"2024-01-16"},{"title":"Cryptojacking via CVE-2023-22527","url":"https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html","authors":"Abdelrahman Esmail (Trend Micro)","date":"2024-08-28"}],"impact":{"kind":"single-product","product":"Atlassian Confluence Data Center and Server","versions":[{"version":"Confluence Data Center and Server 8.0 through 8.4","status":"affected","versions":"8.5.4 / 8.6.0 / 8.7.1","vendorStatement":{"date":"2024-01-16","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","quote":"8.0.x 8.1.x 8.2.x 8.3.x 8.4.x"},"addedDate":"2026-10-24"},{"version":"Confluence Data Center and Server 8.5","status":"affected","versions":">= 8.5.4","vendorStatement":{"date":"2024-01-16","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","quote":"8.5.0-8.5.3"},"addedDate":"2026-10-24"},{"version":"Confluence 7.19.x LTS","status":"vendor-stated-not-affected","vendorStatement":{"date":"2024-01-16","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","quote":"Note: 7.19.x LTS versions are not affected by this vulnerability"},"addedDate":"2026-10-24"},{"version":"Confluence Cloud","status":"vendor-stated-not-affected","vendorStatement":{"date":"2024-01-16","url":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html","quote":"Atlassian Cloud sites are not affected by this vulnerability."},"addedDate":"2026-10-24"}]},"pocs":[{"title":"ProjectDiscovery SSTI analysis and nuclei check","url":"https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution","source":"Rahul Maini, Harsh Jaiswal (ProjectDiscovery)","validationStatus":"validated","validationDate":"2024-01-22","notes":"Public analysis of the unauthenticated Velocity path. The nuclei check uses an OAST callback. This site does not republish exploit payloads.","addedDate":"2026-10-24"},{"title":"Metasploit module atlassian_confluence_rce_cve_2023_22527","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22527.rb","source":"Rapid7 Metasploit","validationStatus":"validated","validationDate":"2024-01-22","notes":"Public module in Metasploit framework. Initial commit b8a0e33ce3ea (22 Jan 2024) is titled Initial exploit for CVE-2023-22527. Listed for defender awareness. This site does not mirror exploit code.","addedDate":"2026-10-24"}],"_feed":{"page":"https://vuln2shell.com/vulns/confluence-ssti","json":"https://vuln2shell.com/vulns/confluence-ssti.json","iocsCsv":"https://vuln2shell.com/vulns/confluence-ssti/iocs.csv","stix":"https://vuln2shell.com/vulns/confluence-ssti/stix.json"}}