---
title: "Confluence CVE-2023-22518: Unauthenticated Reset to Admin"
url: https://erroneo.us/security/briefs/confluence-improper-authorization-cve-2023-22518/
description: "All Confluence Data Center/Server versions let anyone reset the instance and create an admin; used for Cerber ransomware. Patch to 8.5.3+."
type: security-brief
section: "Security Digest"
date_published: 2023-10-31
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2023-22518"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Confluence CVE-2023-22518: Unauthenticated Reset to Admin

**Verdict: Act now.** Any self-hosted Confluence that is reachable from the internet and not on a fixed release can be wiped and taken over by an unauthenticated request; patch or pull it offline, and Atlassian Cloud users have nothing to do.

- **Who must act:** Organizations running self-managed Confluence Data Center or Server below the fixed releases, particularly any instance reachable from the internet.
- **Who can relax:** Atlassian Cloud customers (sites on atlassian.net), which Atlassian says are not affected.
- **Affected:** All versions of Confluence Data Center and Server before the fixed releases
- **Fixed:** 7.19.16; 8.3.4; 8.4.4; 8.5.3; 8.6.1
- **CVEs:** CVE-2023-22518
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Back up the instance and data before making changes.
2. Upgrade to exactly a listed fixed release (7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1) or a newer supported version.
3. If you cannot patch now, remove the instance from the internet, including instances that require login.
4. As a stopgap, block /json/setup-restore.action, /json/setup-restore-local.action and /json/setup-restore-progress.action at the proxy or via web.xml, then restart.
5. If any indicator is present, treat the instance as compromised and follow incident response, including restoring from a known-good backup.

### How to check if you are affected

- Search proxy and access logs for requests to `/json/setup-restore*`, e.g. `grep -E '/json/setup-restore' access_log*`.
- Check for loss of admin login, unexpected members of confluence-administrators, and unexpected new users.
- Look for unknown plugins, notably web.shell.Plugin, and requests to /plugins/servlet/com.jsos.shell/ShellServlet.
- On the host, look for the Confluence Java or Tomcat process spawning bash, cmd or PowerShell, files such as /tmp/qnetd, and ransom notes named read-me3.txt.

## What happened

On October 31, 2023, Atlassian published an [advisory](https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html) for CVE-2023-22518, an improper authorization flaw affecting all versions of Confluence Data Center and Server. An unauthenticated attacker can reset Confluence and create a new instance administrator account, then take any admin action. The result is full loss of confidentiality, integrity and availability, including destroying the existing content. Atlassian's CISO warned of significant data loss risk at publication, when no exploitation was known.

That changed within days. Technical details were posted publicly by November 2. On November 3 a customer reported an active exploit, and Atlassian narrowed its fix table to the exact listed versions. On November 6 Atlassian reported multiple active exploits, including ransomware, and raised its CVSS score from 9.1 to 10.0. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-22518) scores it 9.8.

[Rapid7](https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitation-of-atlassian-confluence-cve-2023-22518/) responded to exploitation across several customer environments on November 5. Process chains were consistent across them, suggesting mass exploitation. Attackers posted to `/json/setup-restore.action`, used the new admin to upload a web shell plugin, ran `whoami`, then pulled down payloads that in several cases deployed Cerber ransomware. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on November 7, 2023, flagged for known ransomware use, and it remains listed as of this writing.

## Who is affected

Self-managed Confluence Data Center and Server on any version below the fixed releases: 7.19.16, 8.3.4, 8.4.4, 8.5.3 and 8.6.1. Atlassian says Cloud sites on `atlassian.net` are not affected. Note that this is a different bug from CVE-2023-22515, the Confluence broken access control flaw disclosed earlier in October 2023.

## Do you really need to act?

If you run self-hosted Confluence that the internet can reach, yes, and it is one of the clearer cases. Exploitation requires no credentials and no user interaction, and has been automated since November 2023. Atlassian specifically told customers to take even login-protected instances off the internet if they could not patch, because the flaw needs no login at all. The damage is not quiet data theft but destruction and ransomware, so the cost of being wrong is high.

Instances reachable only on an internal network carry less risk but are not safe from an attacker already inside. Cloud customers have nothing to do.

## What to do now

1. Back up the instance first.
2. Upgrade to a listed fixed version or a newer supported release. After November 3, Atlassian removed "or later" from its table, so confirm your exact version is listed or newer.
3. If you cannot patch, take the instance off the internet.
4. As a stopgap only, block `/json/setup-restore.action`, `/json/setup-restore-local.action` and `/json/setup-restore-progress.action` at a proxy or with a `web.xml` security constraint, then restart. Atlassian says this does not replace patching.
5. If any indicator below appears, treat the instance as compromised and restore from a known-good backup.

## How to tell if you were hit

Atlassian's indicators: losing admin login access, requests to `/json/setup-restore*` in network logs, unknown plugins such as `web.shell.Plugin`, encrypted or corrupted data, and unexpected members of `confluence-administrators` or new user accounts. Rapid7 adds host-level signs: requests to `/plugins/servlet/com.jsos.shell/ShellServlet`, the Confluence Java or Tomcat process spawning `bash`, `cmd` or PowerShell, a binary at `/tmp/qnetd`, and ransom notes named `read-me3.txt`. Rapid7 also published attacker IP addresses and file hashes.

## Timeline

- Oct 31, 2023 — Atlassian advisory and fixed versions; no known exploitation.
- Nov 2, 2023 — Technical details posted publicly.
- Nov 3, 2023 — Customer reports active exploitation; fix table narrowed.
- Nov 5, 2023 — Rapid7 responds to exploitation leading to Cerber ransomware.
- Nov 6, 2023 — Atlassian confirms multiple exploits and ransomware; CVSS raised to 10.0.
- Nov 7, 2023 — CISA adds CVE-2023-22518 to KEV.

## Sources

1. [Atlassian — CVE-2023-22518: Improper Authorization Vulnerability in Confluence Data Center and Server](https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html)
2. [NVD — CVE-2023-22518](https://nvd.nist.gov/vuln/detail/CVE-2023-22518)
3. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
4. [Rapid7 — Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518](https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitation-of-atlassian-confluence-cve-2023-22518/)

---
Source page: https://erroneo.us/security/briefs/confluence-improper-authorization-cve-2023-22518/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt