CVE Watch—

CVE-2023-22527

Atlassian Confluence Data Center and Server Template Injection Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

Jan 24, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-06-302026-07-16

KEV catalog record

Product

Atlassian / Confluence Data Center and Server

Vulnerability

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Added to KEV

Jan 24, 2024

Remediate by

Feb 14, 2024

Known ransomware use

Yes

Summary description

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22527

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2023-22518—

100.0%

KEV—80Atlassian Confluence Data Center and Server Improper Authorization Vulnerability—CVE-2023-22515—

99.9%

KEV—80Atlassian Confluence Data Center and Server Broken Access Control Vulnerability—