CVE-2023-22515Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

9.8 CRITICALEPSS 99.23%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 05:35 UTC

OverviewCVSS details

9.8CRITICALCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Oct 4, 2023
Assigner: atlassian

Affected

Confluence Data Center (Atlassian)

Versions: >= 8.0.0 · >= 8.0.1

+1 more product →

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Oct 5, 2023
KEV due date: Oct 13, 2023
Ransomware use: Known
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 7

99.23%chance of exploitation in 30 days

Higher than 99.93% of CVEs

CVSS 3.1 · NVD

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 3.0 · atlassian (CNA)

10.0Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10.0	CRITICAL	3.0atlassian (CNA)	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Oct 13, 2023

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.

Details

CVE ID: CVE-2023-22515
Status: Analyzed
Assigner (CNA): atlassian
Published: Oct 4, 2023
Last modified: 2026-06-17 05:35 UTC
Weaknesses: CWE-20

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 14:21 UTC.