Which products and versions are affected by CVE-2023-22518?

Affected: Confluence Data Center (Atlassian) versions 8.6.0, >= >= 1.0.0; Confluence Server (Atlassian) versions 8.6.0, >= >= 1.0.0. The full list is in the CVE brief.

Is CVE-2023-22518 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 2, 2023 and is known to be used in ransomware campaigns.

Is CVE-2023-22518 in the CISA KEV catalog?

Yes. It was added on Nov 7, 2023 with a federal remediation due date of Nov 28, 2023.

Is there a public exploit for CVE-2023-22518?

Public exploit code is available.

Is there a fix for CVE-2023-22518?

Fixed versions are available, including Confluence Data Center 7.19.16, Confluence Server 7.19.16.

How urgently should CVE-2023-22518 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2023-22518

CriticalExploitedPublic exploit

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.

Published Oct 31, 2023 · Updated Oct 21, 2025 · Also known as TR-23-0617

Key Facts

Patch immediately

CVE-2023-22518 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Confluence Data Center (Atlassian), Confluence Server (Atlassian).
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 2, 2023 and is known to be used in ransomware campaigns. Public exploit code is available.
EPSS estimates a 100% probability of exploitation in the next 30 days.
Fixed versions are available, including Confluence Data Center 7.19.16, Confluence Server 7.19.16.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

100%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2023-22518 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Nov 7, 2023	Nov 28, 2023	Known
Industry KEV feed	Nov 2, 2023	Nov 28, 2023	Known
CIRCL KEV	Nov 3, 2023	Nov 28, 2023	Known
ENISA EUVD	Nov 7, 2023	n/a	Not reported

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Products

6 affected entries in total

Product	Affected versions	Fixed in
Confluence Data CenterAtlassian	8.6.0, >= >= 1.0.0	7.19.16
Confluence ServerAtlassian	8.6.0, >= >= 1.0.0	7.19.16

Patched Releases

Confluence Data Center

7.19.16

Confluence Server

7.19.16

Timeline

Publicly disclosed
Oct 31, 2023
Added to Industry KEV feed
Nov 2, 2023
Added to CIRCL KEV
Nov 3, 2023
Added to CISA KEV
Nov 7, 2023
Added to ENISA EUVD
Nov 7, 2023
Last updated
Oct 21, 2025

Weakness Type

CWE-863 Incorrect Authorization

References

10 more references in the full CVE brief

FAQ

Common Questions.

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.
Affected: Confluence Data Center (Atlassian) versions 8.6.0, >= >= 1.0.0; Confluence Server (Atlassian) versions 8.6.0, >= >= 1.0.0. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 2, 2023 and is known to be used in ransomware campaigns.
Yes. It was added on Nov 7, 2023 with a federal remediation due date of Nov 28, 2023.
Public exploit code is available.
Fixed versions are available, including Confluence Data Center 7.19.16, Confluence Server 7.19.16.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2023-22518 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.