References https://isecurity.huawei.com/sec/web/viewAlert.do?id=2426 https://www.h3c.com/cn/d_202211/1715099_30003_0.htm https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/Atlassian-Questions-For-Confluence-%E8%BA%AB%E4%BB%BD%E8%AE%A4%E8%AF%81%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E-CVE-2022-26138.md https://www.nsfocus.net/vulndb/69882 https://avd.aliyun.com/detail?id=AVD-2022-26138 https://jira.atlassian.com/browse/CONFSERVER-79483 https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html https://nvd.nist.gov/vuln/detail/cve-2022-26138 https://github.com/alcaparra/CVE-2022-26138 https://github.com/runZeroInc/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26138.yaml https://www.tenable.com/plugins/was/113328 https://blog.qualys.com/qualys-insights/2022/08/17/atlassian-confluence-questions-for-confluence-app-hardcoded-credentials-cve-2022-26138 https://www.rapid7.com/blog/post/2022/07/27/active-exploitation-of-atlassians-questions-for-confluence-app-cve-2022-26138/
Related VulnerabilitiesPoCCVE-2026-27826: mcp-atlassian < 0.17.0 - Server-Side Request ForgeryMCP Atlassian 存在SSRF漏洞(CVE-2026-27826)PoCconfluence-xslt-macro-ssrf: Atlassian Confluence XSLT Macro - Server-Side Request ForgeryPoCCVE-2017-5983: JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)Atlassian Jira Software Data Center And Server 需授权 路径遍历漏洞CVE-2019-3396: Atlassian Confluence Path TraversalAtlassian Confluence /json/setup-restore.action 文件上传漏洞(CVE-2023-22518)PoCCVE-2015-8399: Atlassian Confluence <5.8.17 - Information DisclosurePoCCVE-2017-9506: Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request ForgeryPoCCVE-2018-20824: Atlassian Jira WallboardServlet <7.13.1 - Cross-Site ScriptingPoCCVE-2018-5230: Atlassian Jira Confluence - Cross-Site Scripting