Is CVE-2022-26138 (Atlassian Questions For Confluence App Hard-coded Credentials) being exploited in the wild?

Yes. CISA added CVE-2022-26138 to its Known Exploited Vulnerabilities catalogue on 29 July 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. Any organisation running the affected product should treat remediation as urgent.

What this CVE means operationally

CVE-2022-26138 is not just a disclosure issue, it is an active-exploitation problem involving hard-coded credentials in an Atlassian Questions for Confluence app. That means the immediate question for defenders is whether the app is present, whether the exposed username and password were reachable, and whether the environment has already been accessed through that trust path.

Because CISA added the CVE to KEV, the practical expectation is that exposure should be treated as an incident-priority issue rather than routine vulnerability backlog work. Use the vendor advisory and the KEV catalogue to confirm the required remediation path and any version-specific details, then move to containment if you cannot remediate immediately.

Why hard-coded credentials change the risk profile

Hard-coded credentials are dangerous because they turn application logic into a reusable authentication secret. If the credential is embedded in the product and discoverable in plaintext, any party who can retrieve it may be able to authenticate as the application or use that access path to reach connected data, services, or administrative functions.

This risk is amplified when the affected app sits inside a collaboration platform where permissions, integrations, and content access can be broad. One compromised credential can become a pivot point, especially if the same secret is reused or trusted across environments. For practical background on this failure mode, see Guide to the Secret Sprawl Challenge, Secrets Management Guide, and OWASP Non-Human Identity Top 10.

What defenders should check first

Start with exposure confirmation: determine whether Questions for Confluence is installed, whether the affected component is reachable, and whether any logs show use of the exposed credential or unusual access from the app account. The relevant question is not whether the product is “patched somewhere upstream,” but whether your environment currently contains the vulnerable app and any active trust relationships built around it.

Then look for follow-on signs of compromise. If the credential had access to Confluence content, connected apps, or administrative actions, review authentication logs, configuration changes, unusual API activity, new integrations, and access to sensitive spaces or attachments. For a structured view of exploitation and triage around actively exploited vulnerabilities, use CISA Known Exploited Vulnerabilities Catalog and NIST National Vulnerability Database.

Risk and Threat Considerations

Hard-coded credentials create a direct compromise path because the secret is not individually issued, rotated, or bounded in the way a normal service credential should be. Once discovered, it can be reused at scale, copied out of the product boundary, or combined with other access paths to move laterally inside the Atlassian environment.

Failure mechanism: The application exposes a reusable username and password in plaintext, allowing an attacker or unauthorized user to authenticate without defeating the normal login flow or waiting for a user interaction.

Impact: The resulting access can support content theft, privilege abuse, unauthorized changes, downstream credential harvesting, or broader platform compromise if the account has trusted reach into other systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-02 — Secret Leakage	Hard-coded credentials are a secret leakage problem.
	NHI-07 — Long-Lived Secrets	Embedded credentials often persist long enough to be abused in the wild.
Recommendation — Locate and remove exposed secrets, then rotate any credentials that may have been disclosed. Replace embedded long-lived credentials with short-lived, rotatable secrets.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	The issue centers on exposed credentials and their lifecycle.
Recommendation — Invalidate exposed authenticators and rotate affected credentials immediately.
CIS Controls v8	CIS-6 — Access Control Management	Compromised app credentials require access revocation and account review.
	CIS-16 — Application Software Security	The vulnerable condition exists inside a third-party application component.
Recommendation — Revoke or restrict the exposed account and remove unnecessary access paths. Track the app, validate vendor remediation, and remove unsafe components promptly.

Practitioner Guidance

What to verify: Confirm whether the affected app is installed, whether the exposed credentials are still valid, and whether the account tied to them has access beyond the minimum needed for the plugin’s function. If you cannot prove the secret is unusable, treat it as compromised.

Decision rule: If the app is present in production, prioritize removal or vendor-directed remediation before debating whether exploitation has already occurred. If business constraints delay that step, disable or isolate the app, rotate any related credentials, and review for suspicious access using the credential’s historical scope.

Practitioner takeaway: The central issue is not the CVE label alone, it is that a hidden application secret became an exploitable authentication path, so response should focus on containment, credential invalidation, and compromise review, not just patch tracking.