Is CVE-2023-22518 (Atlassian Confluence Data Center and Server Improper Authorization) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-22518 to its Known Exploited Vulnerabilities catalogue on 7 November 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker.

What the KEV listing means for CVE-2023-22518

CISA’s KEV catalogue is the key signal here, because it reflects observed exploitation rather than theoretical risk. For this CVE, the practical conclusion is that you should treat the issue as an active threat to exposed Atlassian Confluence Data Center and Server systems, not as a routine backlog item waiting for a standard patch cycle. The right response is driven by exposure and exploitability, not by the age of the advisory alone.

Organizations should confirm whether any Confluence instance is internet-facing, whether it is still receiving administrative access, and whether the affected product is used for sensitive content, integrations, or privileged workflows. If the system is business-critical, the decision point becomes how fast you can reduce exposure without breaking collaboration and content access.

For prioritization, use the authoritative sources that define the event itself: CISA Known Exploited Vulnerabilities Catalog for exploitation status and required action, and the CVE Program record for the vulnerability identity and record lineage.

How to assess exposure and limit blast radius

Start with asset confirmation, because “we run Confluence” is not enough. Identify every Confluence Data Center and Server deployment, including test or secondary environments that may have the same trust relationships, backups, or administrative credentials. If one instance is exposed, assume adjacent systems may also be in scope until proven otherwise.

Then check the access model around the application. Improper authorization bugs often become far more damaging when administrators, integrations, or service accounts have broad permissions, when the application sits behind weak network segmentation, or when single sign-on and shared administrative paths make compromise easier to reuse. The vulnerability may be in Confluence, but the blast radius is often defined by the surrounding identity and access design.

When you need a practical control baseline for authorization and privileged access around Confluence, Atlassian Cloud Security Guide is useful for thinking through permissions, admin controls, and integration exposure, while Authorisation Models Guide helps frame how fine-grained authorization should be structured when the application’s access paths are already complex.

What to do if patching must wait

If you cannot remediate immediately, treat compensating controls as temporary containment, not a substitute for repair. Restrict network reachability, remove unnecessary administrative exposure, disable or tighten any external paths that allow unauthenticated interaction, and review whether the application can be placed behind stronger filtering or segmented access for a short period.

Also reduce the value of a successful exploit. Narrow privileged roles, review integration credentials, and make sure any account or token that can administer or extract content from Confluence is not also valid across unrelated systems. A flaw that starts as application authorization can quickly become a broader trust issue if one compromised path opens too many downstream doors.

If your own response process needs a broader exploitation playbook, Zero-Day and Exploited Vulnerabilities Guide gives the operational context for KEV triage, emergency mitigation, and post-patch hunting, and Vulnerability Management Guide covers prioritization logic that is aligned to active exploitation rather than generic scoring alone.

Risk and Threat Considerations

Because CISA has listed this CVE as actively exploited and tied it to ransomware use, the risk is not just unauthorized access, but rapid follow-on abuse of internal content, credentials, and administrative trust. In practice, an attacker who reaches Confluence may use the platform as a pivot point to collect secrets, map infrastructure, or prepare a wider compromise.

Failure mechanism: Improper authorization allows an unauthenticated attacker to access functionality or data that should have been protected, which can turn a single exposed web application into a broader compromise path.

Impact: Expect potential data loss, unauthorized content access, and secondary exposure if the instance contains operational notes, credentials, tokens, or internal workflow details that aid lateral movement or extortion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Active exploitation of Confluence depends on exposed and misconfigured deployments.
	CIS-7 — Continuous Vulnerability Management	The question is about an actively exploited CVE and emergency prioritization.
Recommendation — Harden Confluence exposure, segmentation, and externally reachable management paths. Prioritize KEV-listed vulnerabilities for urgent remediation and verify closure.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	CVE response requires urgent remediation, mitigation, and verification of affected systems.
	AC-6 — Least Privilege	Improper authorization impact is amplified by excessive access and broad admin rights.
Recommendation — Apply flaw-remediation processes to assess, mitigate, and verify the vulnerable Confluence instance. Limit Confluence and integration privileges to the minimum required for the task.
OWASP ASVS	V8 — Authorization	The vulnerability is an improper authorization flaw in a web application.
Recommendation — Verify authorization checks around all Confluence functions and sensitive objects.

Practitioner Guidance

What to verify: Confirm whether any Confluence deployment is reachable from untrusted networks, whether administrative access paths are tightly limited, and whether sensitive content or embedded credentials exist in spaces, pages, or attachments.

Decision rule: If the instance is internet-facing or contains high-value internal content, treat it as an urgent remediation item and validate containment before assuming the issue is only a software patch problem.

What to measure: Track how quickly exposed instances are identified, contained, patched, and checked for signs of post-exploit activity, because exploitation of a KEV-listed issue is a timing problem as much as a technical one.

Practitioner takeaway: For KEV-listed application flaws, the important question is not whether exploitation is possible, but whether your exposure window is still open and whether the application has already become a path into more sensitive systems.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org