---
title: "Confluence CVE-2023-22527: Pre-Auth OGNL Injection RCE"
url: https://erroneo.us/security/briefs/confluence-cve-2023-22527-ognl-template-injection-rce/
description: "Template injection in Confluence Data Center and Server 8.0-8.5.3 gave unauthenticated RCE; mass-exploited for miners and Sliver. Verify upgrades and hunt."
type: security-brief
section: "Security Digest"
date_published: 2024-01-16
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-22527"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Confluence CVE-2023-22527: Pre-Auth OGNL Injection RCE

**Verdict: Check exposure.** Fixed since December 2023 and mass-exploited since January 2024; confirm no Confluence 8.0 to 8.5.3 build is left, move off end-of-life Server, and if an old instance faced the internet, hunt for miners and implants instead of trusting a later upgrade.

- **Who must act:** Owners of self-managed Confluence Data Center or Server still on 8.0.x through 8.5.3, anyone still running Confluence Server (no security patches since February 15, 2024), and teams whose 8.x instance was internet-facing and unpatched in early 2024.
- **Who can relax:** Atlassian Cloud customers, 7.19.x LTS users for this bug only, and Data Center teams on a current LTS who keep the instance off the open internet.
- **Affected:** Confluence Data Center and Server 8.0.x through 8.4.x, including 8.4.5; Confluence Data Center and Server 8.5.0 through 8.5.3
- **Fixed:** Confluence 8.5.4 LTS and later (Data Center and Server); Confluence Data Center 8.6.0, 8.7.1 and later; Current Data Center lines: at least 9.2.26 or 10.2.19, because of CVE-2026-21589
- **CVEs:** CVE-2023-22527
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Record the version of every Confluence instance from Administration > General Configuration > System Information or the page footer.
2. Upgrade Data Center to a current LTS, at least 9.2.26 or 10.2.19, which also fixes CVE-2026-21589.
3. Retire Confluence Server: it has had no security patches since February 15, 2024; move to Data Center or Cloud.
4. Remove direct internet exposure and put Confluence behind a VPN or an authenticating proxy.
5. If an affected build faced the internet in or after January 2024, run the hunt below, rebuild the host if anything turns up, and rotate the database, LDAP and integration credentials it holds.

### How to check if you are affected

- grep Confluence access logs for POST /template/aui/text-inline.vm; Rapid7 saw these return HTTP 200 in real compromises.
- Search Catalina logs for warnings about an X-Cmd-Response header, which Rapid7 found alongside the miner download URL.
- Look for /tmp/w.sh, javs.tar.gz, a javasgs_miner.service unit, /tmp/X-org, /tmp/X0 and outbound traffic to 38.6.173.11 or 193.29.13.179:8888.
- Check for cron jobs named whoami, nginx or apache, processes running from /tmp, and ssh runs with -oStrictHostKeyChecking=no -oBatchMode=yes from the Confluence host.

## What happened

On January 16, 2024, Atlassian [disclosed](https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html) CVE-2023-22527, a template injection flaw in older Confluence Data Center and Server 8.x builds. It lets an unauthenticated attacker run code on the server. Petrus Viet reported it through Atlassian's bug bounty. The code had already been fixed during regular updates, so only 8.x builds released before December 5, 2023 are affected. There was no workaround. Atlassian, the CNA, scores it CVSS 3.0 10.0 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-22527). [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-22527) gives 9.8.

On January 22, [ProjectDiscovery](https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution) published the root cause. An unauthenticated POST to `/template/aui/text-inline.vm` passes the `label` parameter into an OGNL expression, and a key exposed in the request lets the payload escape the Struts sandbox. The same day, [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-atlassian-confluence-rce-flaw/) reported that Shadowserver had logged more than 39,000 exploitation attempts from just over 600 IP addresses, mostly `whoami` callbacks, and counted 11,100 Confluence instances online. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527) on January 24, 2024, and marks known ransomware use.

Real intrusions followed. [Rapid7](https://www.rapid7.com/blog/post/2024/02/15/rce-to-sliver-ir-tales-from-the-field/) responded to two exploited public Confluence servers that received an XMRigCC miner, then a Sliver command-and-control implant and the Kerbrute, Traitor and Fscan tools. In August 2024, [Trend Micro](https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html) described three actors using the bug for cryptomining. They spread over SSH and persisted through cron.

## Who is affected

Confluence Data Center and Server 8.0.x through 8.4.x, including 8.4.5, and 8.5.0 through 8.5.3. Fixed releases are 8.5.4 LTS and later, and Data Center 8.6.0, 8.7.1 and later. The 7.19.x LTS line and Atlassian Cloud are not affected. Confluence Server itself is end of life. Atlassian's [announcement](https://www.atlassian.com/blog/company-news/farewell-to-server) says Server products stopped receiving "security patches" after February 15, 2024.

## Do you really need to act?

Most teams patched in early 2024, so the verdict is check exposure. Two cases still need work. First, any 8.x instance that faced the internet before it was upgraded may hold a miner, an implant or stolen credentials, and a later upgrade does not remove them. Second, "patched for this CVE" is not enough today. [CVE-2026-21589](https://www.cve.org/CVERecord?id=CVE-2026-21589), an unauthenticated file read in Confluence Data Center fixed in 9.2.26 and 10.2.19, joined [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589) on October 15, 2026. A Server license gets no fix for it.

## What to do now

1. Record each instance's version from Administration > General Configuration > System Information.
2. Upgrade Data Center to a current LTS, at least 9.2.26 or 10.2.19.
3. Plan the move off Confluence Server to Data Center or Cloud, and keep it off the internet until then.
4. Put Confluence behind a VPN or an authenticating proxy.
5. If an affected build was exposed in or after January 2024, run the checks below. If anything turns up, rebuild the host and rotate the database, LDAP and integration credentials it holds.

## How to tell if you were hit

- Search access logs: `grep -h 'POST /template/aui/text-inline.vm' <confluence-install>/logs/*access*`. Rapid7 saw these return 200. Atlassian published no indicators of compromise.
- Look for Catalina log warnings about an `X-Cmd-Response` header. Rapid7 found the miner download URL there.
- Check for `/tmp/w.sh`, `javs.tar.gz`, a `javasgs_miner.service` unit, `/tmp/X-org` or `/tmp/X0`, and traffic to `38.6.173.11` or `193.29.13.179:8888`.
- Per Trend Micro, look for cron jobs named `whoami`, `nginx` or `apache`, processes running from `/tmp`, and `ssh -oStrictHostKeyChecking=no -oBatchMode=yes` runs from the Confluence host.

## Timeline

- Dec 5, 2023 — Builds released from this date are not affected, per Atlassian.
- Jan 16, 2024 — Atlassian publishes the advisory and the CVE.
- Jan 22, 2024 — ProjectDiscovery publishes the root cause, and Shadowserver reports more than 39,000 attempts.
- Jan 24, 2024 — CISA adds the CVE to KEV.
- Feb 15, 2024 — Server support ends. Rapid7 publishes its incident report.
- Aug 28, 2024 — Trend Micro details cryptojacking campaigns.
- Oct 15, 2026 — CVE-2026-21589 joins KEV.

## Sources

1. [Atlassian — CVE-2023-22527: RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server](https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html)
2. [Atlassian — Farewell Server, Hello Cloud](https://www.atlassian.com/blog/company-news/farewell-to-server)
3. [CVE record — CVE-2023-22527](https://www.cve.org/CVERecord?id=CVE-2023-22527)
4. [NVD — CVE-2023-22527](https://nvd.nist.gov/vuln/detail/CVE-2023-22527)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-22527](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527)
6. [CVE record — CVE-2026-21589](https://www.cve.org/CVERecord?id=CVE-2026-21589)
7. [CISA — Known Exploited Vulnerabilities: CVE-2026-21589](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589)
8. [ProjectDiscovery — Atlassian Confluence SSTI Remote Code Execution](https://projectdiscovery.io/blog/atlassian-confluence-ssti-remote-code-execution)
9. [Rapid7 — RCE to Sliver: IR Tales from the Field](https://www.rapid7.com/blog/post/2024/02/15/rce-to-sliver-ir-tales-from-the-field/)
10. [Trend Micro — Cryptojacking via CVE-2023-22527: Dissecting a Full-Scale Cryptomining Ecosystem](https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html)
11. [BleepingComputer — Hackers start exploiting critical Atlassian Confluence RCE flaw](https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-atlassian-confluence-rce-flaw/)

---
Source page: https://erroneo.us/security/briefs/confluence-cve-2023-22527-ognl-template-injection-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt