Atlassian Confluence Zero-Day CVE-2022-26134 Exploited for Malware and Ransomware
Active Exploitation · 8 sources · Updated 3mo ago · First seen Jun 2, 2022
Attackers actively exploited Atlassian Confluence vulnerability CVE-2022-26134, a critical unauthenticated remote code execution flaw caused by OGNL injection, against on-premises Confluence Server and Data Center systems. Volexity first reported in-the-wild exploitation, and Atlassian confirmed that all supported self-managed versions prior to patched releases were affected, while Atlassian Cloud was not vulnerable. Atlassian issued fixed versions including 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1, and also published temporary mitigation steps for organizations unable to patch immediately.
Follow-on attacks used the exploit’s in-memory shell to deliver a wide range of payloads on both Linux and Windows servers, including Gafgyt/Mirai-like botnets, Monero cryptominers, z0miner, Cobalt Strike shellcode, web shells, and a malicious Linux package dubbed pwnkit. Sophos also observed attempts to deploy Cerber ransomware on Windows systems using curl and encoded PowerShell to fetch a payload from the %temp% directory, while Barracuda reported sustained exploitation months after disclosure, with automated reconnaissance, architecture-specific malware downloaders, and some malicious infrastructure remaining online for extended periods.
