CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 29 Jul 2022, 9 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 98.2%
EPSS score, percentile 99.9 of all scored records
- How severe?
- 9.8 Critical
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
Required action (CISA), due 19 Aug 2022: Apply updates per vendor instructions.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected: 2.7.34; 2.7.35; 3.0.2
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply updates per vendor instructions.
CISA due date for this action: 19 August 2022.
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26138
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 2.7.34 |
| Affected | 2.7.35 |
| Affected | 3.0.2 |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2022-26138 to its Known Exploited Vulnerabilities (KEV) catalog on 29 Jul 2022.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 19 Aug 2022.
- The CVE record was published on 20 Jul 2022, 9 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 98.2% (percentile 99.9), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 20 Jul 2022 | CVE record published |
| 29 Jul 2022 | Added to CISA KEV |
| 19 Aug 2022 | CISA due date for the required action |
| 12 Jan 2026 | CVE record last updated |
References
More exploited Atlassian vulnerabilities
- CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability
- CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability
- CVE-2023-22518: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
- CVE-2023-22515: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
- CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability