CVE-2022-26134

This vulnerability is like a “back door” in the Confluence software where an attacker can trick the server into running attacker-chosen code without needing a login. Imagine leaving a toolroom door unlocked and giving instructions that cause the tools to be used in a destructive way automatically. Because it’s been used in real ransomware activity, it’s not something to wait on.

This matters if your business runs Confluence Server, Confluence Data Center, or Jira Data Center on versions that are within the affected ranges (before the listed fixed versions). The key risk is that an attacker doesn’t need an account; they can trigger the problem from the network with crafted requests. This is especially dangerous if the Confluence/Jira app is reachable from the internet (directly or via an exposed reverse proxy), since that’s the access path attackers use.

This is RED because attackers are already known to exploit it in the real world (CISA KEV lists it as used in ransomware campaigns). The vulnerability enables unauthenticated arbitrary code execution, so exposure can turn into full takeover quickly when the service is reachable.