Is CVE-2023-22515 (Atlassian Confluence Data Center and Server Broken Access Control) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-22515 to its Known Exploited Vulnerabilities catalogue on 5 October 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.

What “being exploited in the wild” means for CVE-2023-22515

For this CVE, the practical question is not whether the flaw exists, but whether defenders should treat it as an active incident-response item. CISA’s KEV listing is the clearest signal that exploitation is confirmed, and that shifts the task from routine vulnerability management to urgent exposure checking, remediation, and compromise assessment.

Because the issue is a broken access control weakness in Confluence Data Center and Server, the first concern is unauthorized administrative access rather than simple service disruption. That means the blast radius can include content visibility, configuration changes, and follow-on access to connected systems, especially where Confluence is used as a collaboration hub or integration point.

For background on how to triage and respond to actively exploited flaws, see NHIMG’s Zero-Day and Exploited Vulnerabilities Guide and CISA’s Known Exploited Vulnerabilities Catalog.

What exposure to check first in Confluence

Start by confirming whether any Confluence Data Center or Server instance is reachable in your environment, including test, staging, and separately managed business units. For this kind of flaw, incomplete inventory is a common failure mode because an overlooked node can still be Internet-facing or reachable through internal administrative paths.

Then verify whether the instance was exposed during the exploitation window and whether privileged account creation or unexpected administrative changes occurred. A broken access control issue can create an attacker-controlled admin path quickly, so review audit logs, account creation events, permission changes, and any unusual login or session activity associated with Confluence administrators.

Use the vendor’s advisory for exact product scope and remediation details, and compare your estate against that guidance rather than relying on memory or generic patch policies. The safest operational assumption is that any exposed instance should be treated as potentially affected until proven otherwise.

How to respond when patching cannot happen immediately

If you cannot remediate at once, reduce exposure rather than waiting for a convenient maintenance window. Restrict network reachability to Confluence, harden administrative access paths, and remove any unnecessary external exposure while you prepare the fix and validate the environment.

When a flaw is known to be exploited, compensating controls should be treated as temporary risk reduction, not a substitute for closure. If the instance must remain online, prioritize external containment, heightened monitoring, and a rapid path to patching or upgrade as soon as the vendor and CISA guidance allow.

Follow the vendor advisory for version-specific action and use the KEV catalogue to confirm the urgency of the remediation track. For broader operational prioritisation and exception handling, NHIMG’s Vulnerability Management Guide and Broken Access Control Prevention Guide are useful references.

Risk and Threat Considerations

This is not a theoretical authorization bug. In active exploitation, attackers tend to move quickly from initial access to privilege creation or privilege abuse, because administrative control of a collaboration platform can expose documents, workflows, user data, and integrated systems.

Failure mechanism: The vulnerability allows unauthorized creation of Confluence administrator accounts, so a successful attacker can turn an access-control failure into durable platform control and use that control to extend access or pivot into dependent services.

Impact: Expect potential content exposure, configuration tampering, account compromise, and downstream credential or session abuse if the Confluence instance is integrated with other enterprise systems or trust relationships.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Active exploitation requires confirming where Confluence is deployed and exposed.
Recommendation — Inventory Confluence instances and confirm which are exposed to the vulnerability.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A KEV-listed CVE requires urgent remediation and tracking of vulnerable software.
	AC-6 — Least Privilege	Broken access control enables privilege creation and abuse if access paths are too broad.
Recommendation — Prioritise patching or mitigation for the affected Confluence systems. Restrict administrative access paths and remove unnecessary privilege.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation makes rapid identification and remediation essential.
	CIS-6 — Access Control Management	The flaw directly concerns unauthorized access and admin account creation.
Recommendation — Use continuous vulnerability management to find and close exposed Confluence instances. Review and tighten Confluence access paths, especially administrative ones.

Practitioner Guidance

What to verify: Check whether any Confluence instance was internet-reachable, whether new admin accounts appeared unexpectedly, and whether privilege or authentication events line up with the KEV date and any surrounding anomaly window.

Escalation / exception: If the system supported administrative account creation outside normal change control, treat that as a high-confidence compromise indicator and escalate to incident response before assuming the platform is merely vulnerable.

Practitioner takeaway: For a KEV-listed broken access control flaw, the right decision is to assume exposure is actionable until logs, account state, and remediation evidence prove otherwise.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org