Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (CVE-2023-22518)

What is affected, what to do

This vulnerability allows an unauthenticated attacker to impersonate an administrator in Confluence Data Center and Server, performing administrative actions that lead to a complete loss of confidentiality, integrity, and availability. All versions of Confluence Data Center and Server are affected, but Atlassian Cloud sites are not. It is actively exploited in ransomware campaigns since November 2023. Immediate patching to the latest versions is critical to mitigate the risks.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Atlassian Confluence Data Center to version 7.19.16, Atlassian Confluence Server to version 7.19.16. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Atlassian Confluence Data Center lt 1.0.0..7.19.16
• Atlassian Confluence Server lt 1.0.0..7.19.16

Fixed in

• Atlassian Confluence Data Center 7.19.16
• Atlassian Confluence Server 7.19.16

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Find exposure and cut internet access now: Inventory every Confluence Data Center/Server instance, including test, staging and forgotten legacy boxes. Put any internet-facing instance behind VPN or an allowlisted reverse proxy until it is patched. atlassian.net Cloud sites are not affected.
   • Patch: Upgrade to fixed release 7.19.16, 8.3.4, 8.4.4 or 8.5.3, depending on your release line. For 8.6.0, the supplied context lists no fixed version — a patch is available from the vendor; look up the exact version in the Atlassian advisory. Versions older than 7.19 are end-of-life and must move to a patched LTS line.
   • Interim block if you cannot patch immediately: On the reverse proxy or WAF, return HTTP 403 for /json/setup-restore.action, /json/setup-restore-local.action and /json/setup-restore-progress.action. These are the abused restore endpoints.
   • Compromise check before patching: Grep Tomcat access logs for POSTs to /json/setup-restore*. Also look for unknown members of confluence-administrators, newly installed plugins, and missing spaces or pages. If you get hits, isolate the host and preserve evidence rather than patching and carrying on.
   • Protect backups: Move current database and home-directory backups offline or to immutable storage, then verify integrity. Exploitation lets an attacker wipe the instance, and CISA confirms ransomware use.
   • Rotate secrets if compromise is suspected: Rotate the DB credentials in confluence.cfg.xml, service-account passwords, Application Links/OAuth tokens and local admin passwords.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Expose Confluence only to user or management VLANs or via VPN. Apply default-deny egress from the Confluence host so attackers cannot pull tooling or reach C2.
   • WAF/IPS rule: Block URIs matching ^/json/setup-restore(-local|-progress)?\.action for any HTTP method. Normalise path tricks first (;jsessionid=, double slashes, URL encoding). Also drop multipart ZIP uploads to /json/* from untrusted networks. Suricata shape: http.uri; content:"/json/setup-restore"; nocase;.
   • Endpoint hardening: Run Confluence under a dedicated unprivileged service account. Minimise write access to the install directory and plugin paths. Enable an EDR policy that blocks shell children of the Confluence JVM.
   • IAM/least privilege: Keep confluence-administrators membership minimal and alert on changes. Enforce SSO with MFA for admin access. Note that the bug bypasses authentication entirely, so MFA only limits reuse of stolen accounts.
   • Configuration/resilience: Keep the restore function blocked at the proxy during normal operations and open it only in maintenance windows. Follow 3-2-1 backups with an offline copy, and test your Confluence recovery time.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs (Tomcat conf_access_log/proxy): Watch for POSTs to /json/setup-restore.action, /json/setup-restore-local.action or /json/setup-restore-progress.action, especially with parameters like synchronous=true. SPL: index=web uri_path="/json/setup-restore*" method=POST | stats count by src_ip, uri_path, status.
   • Confluence audit/application log: Flag unexpected site restore or import entries in atlassian-confluence.log outside maintenance windows. Also flag new users added straight to confluence-administrators, and plugin uploads via /admin/uploadplugin.action by unfamiliar accounts.
   • EDR/Sysmon process ancestry: Sysmon EID 1 or EDR telemetry where the parent is java.exe/tomcat*.exe (Windows) or java running as the Confluence user (Linux), and the child is cmd.exe, powershell.exe, bash, sh, curl or wget. Sigma shape: ParentImage|endswith: '\java.exe' AND Image|endswith: ['\cmd.exe','\powershell.exe'], scoped to Confluence hosts.
   • Linux auditd/file system: Look for execve events with the Confluence service account uid. Also look for new .jar or .jsp files under the install or home directory (Sysmon EID 11, or an auditd watch on plugins/). Mass renames or writes with new file extensions indicate encryption.
   • Network (Zeek/Suricata): Alert on outbound connections from the Confluence server to unknown external IPs shortly after restore-endpoint requests. Large outbound transfers (conn.log with high orig_bytes) are also suspicious.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Source: CSA/SingCERT, pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE), BSI WID Portal, BSI CSAF

Vendors and products

• Atlassian Confluence Data Center
• Atlassian Atlassian Confluence Server

References & sources

• confluence.atlassian.compages/viewpage.action?pageId=1311473907Issue tracking, Mitigation, Vendor advisory
• jira.atlassian.combrowse/CONFSERVER-93142Issue tracking, Mitigation, Vendor advisory
• packetstormsecurity.comfiles/176264/Atlassian-Confluence-Improper-Authorization-Code-E…Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518government-resource, US government resource
• cert.atCERT.at: Kritische Sicherheitslücke in Confluence Data Center und Confluence Servercert-at
• pwn.watchpwn.watch: Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)pwn-watch
• confluence.atlassian.comCVE-2023-22518 - Improper Authorization Vulnerability in Confluence Data Center and Serverpwn-watch
• NVD (NIST)NVD: CVE-2023-22518pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch