---
title: "Confluence CVE-2023-22515: Zero-Day Admin Account Creation"
url: https://erroneo.us/security/briefs/confluence-cve-2023-22515-broken-access-control-admin-creation/
description: "Confluence Data Center/Server 8.0.0-8.5.1 let anyone create an admin; exploited by a state actor. Fixed in 8.3.3, 8.4.3, 8.5.2. Check old 8.x hosts."
type: security-brief
section: "Security Digest"
date_published: 2023-10-04
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-22515"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Confluence CVE-2023-22515: Zero-Day Admin Account Creation

**Verdict: Check exposure.** Fixed since October 2023, but it was a nation-state zero-day; make sure no Confluence 8.x host is still on 8.0.0-8.5.1, and if one was internet-facing then, audit its admin accounts rather than trusting the later upgrade.

- **Who must act:** Owners of self-managed Confluence Data Center or Server that ran 8.0.0 through 8.5.1 while reachable from the internet, and anyone still on an unsupported Confluence build.
- **Who can relax:** Atlassian Cloud customers on atlassian.net, and self-managed instances that stayed on 7.x or upgraded promptly and keep current Data Center releases.
- **Affected:** Confluence Data Center and Server 8.0.0-8.0.4, 8.1.0, 8.1.1, 8.1.3, 8.1.4, 8.2.0-8.2.3, 8.3.0-8.3.2, 8.4.0-8.4.2, 8.5.0, 8.5.1; Versions before 8.0.0 are not affected
- **Fixed:** 8.3.3 or later; 8.4.3 or later; 8.5.2 (LTS) or later; Current Data Center lines: at least 9.2.26 or 10.2.19, because of CVE-2026-21589
- **CVEs:** CVE-2023-22515
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every self-managed Confluence instance and record its exact version.
2. Upgrade anything on 8.0.0-8.5.1 now, and move all instances to a current Data Center release (9.2.26, 10.2.19 or later) to cover later KEV bugs too.
3. Retire Confluence Server: it reached end of support on February 15, 2024.
4. Keep Confluence off the open internet; put it behind a VPN, SSO proxy or IP allowlist.
5. If an affected version was internet-facing in fall 2023, run the hunt below; if anything is found, follow CISA's advice to reimage and rotate credentials rather than only deleting the rogue admin.

### How to check if you are affected

- Review the confluence-administrators group and recently created users for accounts nobody recognizes.
- grep access logs for /server-info.action requests with setupComplete in the query string and for any /setup/*.action request on a running instance.
- Search atlassian-confluence-security.log in the Confluence home directory for /setup/setupadministrator.action in exception messages.
- Check for unknown installed plugins and for curl or rclone runs from the Confluence host, the exfiltration tools CISA observed.

## What happened

On October 4, 2023, Atlassian published an [advisory](https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html) for CVE-2023-22515 in self-managed Confluence Data Center and Server. It was already a zero-day. A handful of customers had reported attackers creating unauthorized administrator accounts on internet-facing instances. Atlassian, as CNA, scores it CVSS 3.0 10.0 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-22515). It first called the bug privilege escalation, then reclassified it as broken access control.

[Rapid7's analysis](https://www.rapid7.com/blog/post/ra-cve-2023-22515-analysis/) explains the mechanism. The unauthenticated `/server-info.action` endpoint accepted a nested parameter that reached a setter for the application's "setup complete" flag. Setting it to false reopened the setup wizard. A POST to `/setup/setupadministrator.action` with `X-Atlassian-Token: no-check` then created a new admin. The fix tightened parameter filtering, made the configuration read-only and removed `/server-info.action`.

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515) on October 5, 2023, with an October 13 deadline, and marks it as known to be used in ransomware campaigns. On October 10, Atlassian added that a known nation-state actor was exploiting it. Microsoft named the group Storm-0062 and said it had exploited the bug since September 14, three weeks before disclosure, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/microsoft-state-hackers-exploiting-confluence-zero-day-since-september/). On October 16, CISA, the FBI and MS-ISAC published [AA23-289A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a). It says exploitation continued after the patch and that attackers exfiltrated data with cURL and Rclone.

## Who is affected

Confluence Data Center and Server 8.0.0 through 8.5.1. Versions before 8.0.0 and Atlassian Cloud sites are not affected. Fixed releases are 8.3.3, 8.4.3 and 8.5.2 (LTS) or later. This is a different bug from CVE-2023-22518, the setup-restore flaw disclosed on October 31, 2023 that affected all versions and led to Cerber ransomware.

## Do you really need to act?

Most teams patched in 2023, so today's verdict is to check exposure. Two risks remain. First, a rogue admin created before the upgrade survives it. CISA warned that removing that account may not be enough, because attackers may have planted other persistence. Second, an instance still on 8.x is exposed to every later Confluence bug, including [CVE-2026-21589](https://www.cve.org/CVERecord?id=CVE-2026-21589), an unauthenticated file read added to KEV on October 15, 2026 and fixed in Confluence Data Center 9.2.26 and 10.2.19. Confluence Server also reached end of support on February 15, 2024, per [Atlassian](https://www.atlassian.com/blog/company-news/farewell-to-server).

## What to do now

1. Record each instance's exact version from the page footer or the System Information page under General Configuration.
2. Upgrade anything on 8.0.0-8.5.1 now. Then move to a current Data Center release, 9.2.26, 10.2.19 or later.
3. Migrate off Confluence Server.
4. Keep Confluence behind a VPN, SSO proxy or IP allowlist.
5. If an affected build was internet-facing in fall 2023, run the checks below. On any hit, assume full admin compromise, reimage and rotate credentials.

## How to tell if you were hit

- Look for unexpected members of `confluence-administrators`, unknown new users and unknown plugins.
- Run `grep -E 'server-info.action.*setupComplete|/setup/[a-z]+\.action' access_log*` on proxy and Tomcat logs. A setup request on a running instance is suspicious.
- Search `atlassian-confluence-security.log` for `/setup/setupadministrator.action` in exception messages, as Atlassian advises.
- Check the host for curl or Rclone uploads to cloud storage. AA23-289A lists User-Agents `Python-requests/2.27.1` and `curl/7.88.1` and five exfiltration IPs.

## Timeline

- Sep 14, 2023 — Earliest exploitation reported by Microsoft (Storm-0062).
- Oct 4, 2023 — Atlassian advisory and fixed releases.
- Oct 5, 2023 — CISA adds CVE-2023-22515 to KEV.
- Oct 10, 2023 — Atlassian confirms nation-state exploitation.
- Oct 16, 2023 — Joint advisory AA23-289A.
- Feb 15, 2024 — Confluence Server reaches end of support.
- Oct 15, 2026 — CVE-2026-21589 joins KEV.

## Sources

1. [Atlassian — CVE-2023-22515: Broken Access Control Vulnerability in Confluence Data Center and Server](https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html)
2. [CVE record — CVE-2023-22515](https://www.cve.org/CVERecord?id=CVE-2023-22515)
3. [NVD — CVE-2023-22515](https://nvd.nist.gov/vuln/detail/CVE-2023-22515)
4. [CISA — Known Exploited Vulnerabilities: CVE-2023-22515](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515)
5. [CISA, FBI, MS-ISAC — AA23-289A: Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a)
6. [Rapid7 — Rapid7 Analysis: CVE-2023-22515](https://www.rapid7.com/blog/post/ra-cve-2023-22515-analysis/)
7. [Atlassian — Farewell Server, Hello Cloud](https://www.atlassian.com/blog/company-news/farewell-to-server)
8. [CVE record — CVE-2026-21589](https://www.cve.org/CVERecord?id=CVE-2026-21589)
9. [BleepingComputer — Microsoft: State hackers exploiting Confluence zero-day since September](https://www.bleepingcomputer.com/news/security/microsoft-state-hackers-exploiting-confluence-zero-day-since-september/)

---
Source page: https://erroneo.us/security/briefs/confluence-cve-2023-22515-broken-access-control-admin-creation/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt