Is CVE-2019-3398 (Atlassian Confluence Server and Data Center Path Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2019-3398 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files.

How KEV status answers the exploitation question

For a CVE like this, the practical question is not whether exploitation is theoretically possible, but whether there is reliable evidence that attackers are already using it. CISA’s KEV catalogue is the fastest authoritative signal for that answer, because inclusion means the vulnerability has crossed from disclosure into active exploitation and should be treated as an operational issue, not a background risk.

That matters because “exploited in the wild” changes triage. Once a flaw is in KEV, exposure is no longer limited to vulnerable configuration alone, it becomes a question of whether the affected product is present, reachable, and likely already targeted.

Why this vulnerability is operationally important

This issue affects Atlassian Confluence Server and Data Center through a path traversal weakness in the downloadallattachments resource. In practice, path traversal matters because it can let an attacker move outside the intended file-handling boundary and reach files or write paths the application should not expose. The fact that the flaw requires privileged, remote access does not make it benign, it narrows the attacker profile to high-impact footholds and abuse of existing trust.

When a vulnerability combines file-path control with an application that often sits inside a collaboration environment, the concern is not just one endpoint being touched. It is whether the application boundary can be used to alter stored content, stage follow-on activity, or interfere with attachment handling in a way that supports persistence or lateral movement.

What to verify before you declare yourself safe

Start by confirming whether any Confluence Server or Data Center instance is still deployed anywhere in the environment, including forgotten test, staging, or subsidiary-managed systems. Then verify whether internet exposure, partner exposure, or overly broad internal reachability exists, because active exploitation risk rises sharply when the service is easy to reach and lightly monitored.

You should also confirm whether logging is sufficient to reconstruct suspicious attachment-download activity, unexpected file writes, or other abnormal application behavior around the vulnerable resource. If you cannot answer those questions quickly, treat the host as an incident candidate rather than as a routine patching task.

Risk and Threat Considerations

This type of flaw is attractive to attackers because path traversal can turn a normal application endpoint into a file-access primitive. When the vulnerable product is a collaboration platform, the payoff can include tampering, unauthorized file placement, or stepping stone access that supports deeper compromise.

Failure mechanism: The application fails to enforce the intended file-path boundary on a resource that processes attachment-related requests, allowing an attacker with the needed privileges to influence file handling in ways the application should block.

Impact: Successful abuse can expose or alter data, enable persistence through malicious file placement, and create a foothold for further compromise of the wider Confluence environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires urgent vuln prioritisation and remediation.
Recommendation — Prioritize KEV-listed flaws for rapid remediation and exposure reduction.
NIST CSF 2.0	DE.CM-01 — Security Continuous Monitoring	Exploit-in-the-wild decisions depend on monitoring exposed systems and abnormal activity.
Recommendation — Monitor vulnerable systems for suspicious activity and exposure changes.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-driven triage depends on identifying and tracking vulnerable assets.
	SI-2 — Flaw Remediation	Actively exploited vulnerabilities require prompt corrective action and verification.
Recommendation — Scan for affected assets and track remediation until exposure is removed. Apply and verify remediation for actively exploited vulnerabilities as soon as possible.
OWASP ASVS	V5 File Handling — File Handling	Path traversal is a file-handling control failure that ASVS addresses directly.
Recommendation — Validate file paths and constrain file access to intended directories.

Practitioner Guidance

What to prioritise: Treat KEV-listed vulnerabilities as exposure management items, not as ordinary backlog entries. If an affected Confluence instance exists, prioritise isolation, patching or mitigation, and then verify that the vulnerable path is no longer reachable in practice.

What to verify: Confirm whether the system has already shown signs of earlier compromise before you close the ticket. For application flaws like this, post-remediation validation should include file-integrity review, suspicious attachment activity review, and a search for unexpected account or permission changes that may have accompanied exploitation.

Practitioner takeaway: With a KEV-listed vulnerability, the right question is not “is it dangerous in theory?”, it is “has this system already been exposed long enough to be treated as potentially compromised?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org