CVE-2023-22515: Three Years of Confluence Exploitation

CVE-2023-22515’s EPSS score is 0.99156 as of July 2026. That’s the figure FIRST.org’s exploitation probability model produces when it’s confident — based on observed exploitation data, not theoretical severity — that a vulnerability is being actively targeted. The October 2023 disclosure is nearly three years behind us. The number has barely moved.

Atlassian disclosed the flaw on October 4, 2023, noting in the same statement that active exploitation against a small number of customers had already been observed before the advisory was published. CISA added it to the Known Exploited Vulnerabilities catalog within days. By mid-October, Atlassian had confirmed broader exploitation as proof-of-concept details circulated publicly.

The mechanism is straightforward enough that “broken access control” undersells how it read in practice. Confluence Data Center and Server ships with an API endpoint designed to handle initial instance setup — the first-run wizard that creates the administrator account. That endpoint was supposed to be usable once, at installation. It wasn’t protected against being called again on a fully deployed instance. CVE-2023-22515 is what happens when the answer to “can a remote, unauthenticated user hit that endpoint on your production instance and create their own admin account?” was yes.

Why Confluence specifically

The product matters here as much as the vulnerability class. Confluence is where organizations write down the things they don’t want external parties to read: LDAP server configurations, VPN credentials pasted into a quick-reference page, database connection strings in a DevOps runbook, architecture diagrams detailing internal network topology. For an attacker whose follow-on objective is ransomware staging or lateral movement through a network, administrator access to the Confluence instance is access to the organization’s annotated map of itself. The reconnaissance value is significant and often underappreciated relative to the access value.

This isn’t the first time Confluence has appeared in this context. CVE-2022-26134 — an OGNL template injection that allowed unauthenticated remote code execution on Confluence Server and Data Center — ran through the same sequence a year earlier: critical severity, CISA KEV addition, mass exploitation that continued well past the patch release. CVE-2023-22515 is a second wave against the same target with a different technical approach. The playbook didn’t change. The exploitation followed.

What the EPSS number means at year three

An EPSS score of 0.99 isn’t a statement about what percentage of systems have been compromised. It’s a statement about where this vulnerability sits in the current exploitation probability distribution relative to everything else with a CVE number. The model is still seeing enough signal around CVE-2023-22515 to keep it near the top. That signal comes from observed behavior, not from the original severity score or the age of the vulnerability.

The CVSS score is 9.8. The flaw is patched. Those facts have been true since October 2023. The EPSS score is the part that reflects what’s actually happening in 2026, and what’s happening is that Confluence instances running unpatched builds are still being scanned for and targeted. This isn’t a historical curiosity at year three — it’s an active exposure for organizations still running affected versions.

Atlassian’s patch guidance and affected version ranges are in the NVD record. Cloud-hosted Confluence required no action and was not affected. The exposure surface is on-premises Confluence Data Center and Server only. The CVE-2023-22515 entry on this site has the current EPSS and KEV status.

The practical read

If your organization runs on-premises Confluence Data Center or Server and hasn’t explicitly confirmed it’s on a patched build, that confirmation is overdue by about thirty-four months. Confluence instances sitting behind a corporate network perimeter still matter here: lateral attackers who’ve already reached the internal network value the documentation stored in Confluence for exactly the same reasons external attackers do.

The gap between “this is patched” and “we have confirmed our instance is on the patched build” is the gap CVE-2023-22515 still lives in. The gap between October 2023 and July 2026 is long enough that the answer to “have we patched this?” should not require any research. If it does, the answer is functionally no.

For similar retrospectives on the 2023 mass-exploitation wave: MOVEit CVE-2023-34362 at year three.