{"basis":"claimed","id":"CVE-2022-26134","name":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","vendorProject":"Atlassian","product":"Confluence Server/Data Center","publishedAt":"2022-06-03","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2022-06-02","dueDate":"2022-06-06","ransomware":true},"epss":{"score":0.99999,"percentile":0.99993,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"rule","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"no_history","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"no_history","firstOn":null,"daysToRule":null}},"title":null,"description":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.","cwes":["CWE-917"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"rule","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[{"id":"83a126d3a8fd35c12192578f6bf4bd351979474fec6691752d33ce7590532c91","cve_id":"CVE-2022-26134","vendor":"azure","product":"Front Door WAF (DRS)","rule_id":"932130","rule_name":"Remote Command Execution: Unix Shell Expression or Confluence Vulnerability (CVE-2022-26134) Found","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs","source_title":"Front Door WAF (DRS) rule groups and rules","excerpt":"Rule 932130: Critical - 5 · 1 · Remote Command Execution: Unix Shell Expression or Confluence Vulnerability (CVE-2022-26134) Found","first_seen_at":"2026-11-02T21:00:19.031Z"},{"id":"9797cc04303e9875669f2302636ceebd34c7db0c70ae6d3b3dd3f4fd1363dca1","cve_id":"CVE-2022-26134","vendor":"azure","product":"Application Gateway WAF (DRS/CRS)","rule_id":"932130","rule_name":"Remote Command Execution: Unix Shell Expression or Confluence Vulnerability (CVE-2022-26134) Found","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","source_title":"Application Gateway WAF (DRS/CRS) rule groups and rules","excerpt":"Rule 932130: Critical - 5 · 1 · Remote Command Execution: Unix Shell Expression or Confluence Vulnerability (CVE-2022-26134) Found","first_seen_at":"2026-11-02T21:00:19.031Z"}]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-03T03:17:40.646Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2022-26134","templatePath":"http/cves/2022/CVE-2022-26134.yaml","requests":2,"blockedRequests":2,"rules":["933135","933160","944130"],"note":"","requestDetail":[{"method":"GET","path":"/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.…","status":403,"blocked":true,"rules":["933135","933160","944130"]},{"method":"GET","path":"/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20oas…","status":403,"blocked":true,"rules":["933135","933160","944130"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2022-26134","templatePath":"http/cves/2022/CVE-2022-26134.yaml","requests":2,"blockedRequests":2,"rules":["933135","933160","944130"],"note":"","requestDetail":[{"method":"GET","path":"/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.…","status":403,"blocked":true,"rules":["933135","933160","944130"]},{"method":"GET","path":"/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20oas…","status":403,"blocked":true,"rules":["933135","933160","944130"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}