CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 19 August 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 98.24% probability · 100th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 29 July 2022 · due 19 August 2022
- Weakness
- CWE-798
- Affected
- atlassian/questions for confluence
- Source
- security@atlassian.com
EPSS 98.2% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply updates per vendor instructions. https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html; https://nvd.nist.gov/vuln/detail/CVE-2022-26138
References
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.htmlVendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-79483Issue Tracking, Patch, Vendor Advisory
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.htmlVendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-79483Issue Tracking, Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.