Confluence CVE-2023-22515: Zero-Day Admin Account Creation

What to do

1. List every self-managed Confluence instance and record its exact version.
2. Upgrade anything on 8.0.0-8.5.1 now, and move all instances to a current Data Center release (9.2.26, 10.2.19 or later) to cover later KEV bugs too.
3. Retire Confluence Server: it reached end of support on February 15, 2024.
4. Keep Confluence off the open internet; put it behind a VPN, SSO proxy or IP allowlist.
5. If an affected version was internet-facing in fall 2023, run the hunt below; if anything is found, follow CISA's advice to reimage and rotate credentials rather than only deleting the rogue admin.

How to check if you are affected or compromised

• Review the confluence-administrators group and recently created users for accounts nobody recognizes.
• grep access logs for /server-info.action requests with setupComplete in the query string and for any /setup/*.action request on a running instance.
• Search atlassian-confluence-security.log in the Confluence home directory for /setup/setupadministrator.action in exception messages.
• Check for unknown installed plugins and for curl or rclone runs from the Confluence host, the exfiltration tools CISA observed.

What happened#

On October 4, 2023, Atlassian published an advisory for CVE-2023-22515 in self-managed Confluence Data Center and Server. It was already a zero-day. A handful of customers had reported attackers creating unauthorized administrator accounts on internet-facing instances. Atlassian, as CNA, scores it CVSS 3.0 10.0 on the CVE record. It first called the bug privilege escalation, then reclassified it as broken access control.

Rapid7's analysis explains the mechanism. The unauthenticated /server-info.action endpoint accepted a nested parameter that reached a setter for the application's "setup complete" flag. Setting it to false reopened the setup wizard. A POST to /setup/setupadministrator.action with X-Atlassian-Token: no-check then created a new admin. The fix tightened parameter filtering, made the configuration read-only and removed /server-info.action.

CISA added the CVE to the KEV catalog on October 5, 2023, with an October 13 deadline, and marks it as known to be used in ransomware campaigns. On October 10, Atlassian added that a known nation-state actor was exploiting it. Microsoft named the group Storm-0062 and said it had exploited the bug since September 14, three weeks before disclosure, according to BleepingComputer. On October 16, CISA, the FBI and MS-ISAC published AA23-289A. It says exploitation continued after the patch and that attackers exfiltrated data with cURL and Rclone.

Who is affected#

Confluence Data Center and Server 8.0.0 through 8.5.1. Versions before 8.0.0 and Atlassian Cloud sites are not affected. Fixed releases are 8.3.3, 8.4.3 and 8.5.2 (LTS) or later. This is a different bug from CVE-2023-22518, the setup-restore flaw disclosed on October 31, 2023 that affected all versions and led to Cerber ransomware.

Do you really need to act?#

Most teams patched in 2023, so today's verdict is to check exposure. Two risks remain. First, a rogue admin created before the upgrade survives it. CISA warned that removing that account may not be enough, because attackers may have planted other persistence. Second, an instance still on 8.x is exposed to every later Confluence bug, including CVE-2026-21589, an unauthenticated file read added to KEV on October 15, 2026 and fixed in Confluence Data Center 9.2.26 and 10.2.19. Confluence Server also reached end of support on February 15, 2024, per Atlassian.

What to do now#

1. Record each instance's exact version from the page footer or the System Information page under General Configuration.
2. Upgrade anything on 8.0.0-8.5.1 now. Then move to a current Data Center release, 9.2.26, 10.2.19 or later.
3. Migrate off Confluence Server.
4. Keep Confluence behind a VPN, SSO proxy or IP allowlist.
5. If an affected build was internet-facing in fall 2023, run the checks below. On any hit, assume full admin compromise, reimage and rotate credentials.

How to tell if you were hit#

• Look for unexpected members of confluence-administrators, unknown new users and unknown plugins.
• Run grep -E 'server-info.action.*setupComplete|/setup/[a-z]+\.action' access_log* on proxy and Tomcat logs. A setup request on a running instance is suspicious.
• Search atlassian-confluence-security.log for /setup/setupadministrator.action in exception messages, as Atlassian advises.
• Check the host for curl or Rclone uploads to cloud storage. AA23-289A lists User-Agents Python-requests/2.27.1 and curl/7.88.1 and five exfiltration IPs.

Timeline#

• Sep 14, 2023 — Earliest exploitation reported by Microsoft (Storm-0062).
• Oct 4, 2023 — Atlassian advisory and fixed releases.
• Oct 5, 2023 — CISA adds CVE-2023-22515 to KEV.
• Oct 10, 2023 — Atlassian confirms nation-state exploitation.
• Oct 16, 2023 — Joint advisory AA23-289A.
• Feb 15, 2024 — Confluence Server reaches end of support.
• Oct 15, 2026 — CVE-2026-21589 joins KEV.

Vulnerability records

• CVE-2023-22515 · KEV 2023-10-05 · Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Atlassian — CVE-2023-22515: Broken Access Control Vulnerability in Confluence Data Center and Server confluence.atlassian.com
2. CVE record — CVE-2023-22515 cve.org
3. NVD — CVE-2023-22515 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2023-22515 cisa.gov
5. CISA, FBI, MS-ISAC — AA23-289A: Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks cisa.gov
6. Rapid7 — Rapid7 Analysis: CVE-2023-22515 rapid7.com
7. Atlassian — Farewell Server, Hello Cloud atlassian.com
8. CVE record — CVE-2026-21589 cve.org

Coverage and analysis

1. BleepingComputer — Microsoft: State hackers exploiting Confluence zero-day since September bleepingcomputer.com