How do you patch or mitigate CVE-2022-26134 (Atlassian Confluence Server and Data Center Remote Code Execution)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2022-26134 is to immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [ OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What this CVE means operationally for Confluence

The practical response is immediate containment plus vendor-directed remediation. For this issue, that means cutting off internet exposure to the affected Confluence instances while you apply the update or remove the product if patching cannot meet the due date. Treat this as an exploitable remote code execution condition, not a routine maintenance fix.

Because the vulnerability was used in the wild, you should assume that any exposed system may have been targeted before the fix was applied. That changes the response from “patch and move on” to “patch, then verify whether the host was used for execution, staging, or follow-on access.”

How to confirm exposure and reduce blast radius

Start by identifying every Confluence Server and Data Center deployment that is reachable from untrusted networks, including instances behind reverse proxies, load balancers, or published through temporary rules. If the service is exposed directly or indirectly, the first control is to block all internet traffic to and from the affected products, then preserve enough access for administrators to complete remediation safely.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog as the authoritative references for the required action and timing, and use the Atlassian remediation instructions for the exact update path. In practice, the priority is to remove attack reachability first, then restore normal access only after the fix is confirmed to be in place.

If the environment cannot be patched immediately, the safest interim posture is to keep the service isolated and tightly controlled rather than partially exposed. Partial exposure is rarely a stable mitigation for an actively exploited RCE, because a single reachable endpoint can be enough to regain code execution.

What to do after patching or when patching must wait

Once the update is successfully deployed, reassess the internet blocking rules and remove only the restrictions that are no longer needed. Do not relax containment until you have confirmed the fixed version is running on every affected node and that the instance is no longer externally reachable in ways that matter.

If patching must wait, focus on compensating controls that reduce exposure without pretending to eliminate it. That means strict network blocking, narrower administrative access, careful monitoring of the application host, and a plan to accelerate the update or retire the product if remediation cannot be completed within the required window.

Risk and Threat Considerations

This vulnerability is high risk because remote code execution on a collaboration platform can become a foothold for broader compromise, data access, and internal lateral movement. The threat is not just initial shell execution, it is the speed with which an attacker can turn a public-facing application into persistent access.

Failure mechanism: An exposed Confluence instance can be reached remotely, exploited to execute attacker-controlled code, and then used to run discovery, deploy payloads, or harvest application data before defenders notice.

Impact: Expect possible content theft, credential or session exposure, internal pivoting, and lingering compromise even after the vulnerable service is patched if you do not check for prior activity.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE-2022-26134 requires urgent remediation and exposure reduction.
Recommendation — Prioritise, patch, and verify exploited vulnerabilities on internet-facing systems.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The answer centers on applying vendor updates and handling a known exploited flaw.
	IR-4 — Incident Handling	Because exploitation was used in the wild, post-patch compromise review is required.
Recommendation — Track, remediate, and verify the security update across all affected Confluence instances. Investigate exploitation indicators and confirm whether the host was used before remediation.
OWASP ASVS	V13 — Configuration	Internet blocking and safe deployment state depend on secure configuration and exposure control.
Recommendation — Harden deployment exposure and validate that externally reachable attack paths are removed.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	This CVE is a public-facing application RCE, so exploit-path analysis is directly relevant.
Recommendation — Hunt for exploitation of the exposed Confluence service and trace attacker activity from the initial foothold.

Practitioner Guidance

What to prioritise: Containment first, then patch verification, then compromise assessment. If the instance was internet-facing at any point, treat log review as a required post-fix step, not an optional clean-up task.

What to verify: Confirm the update actually landed on every affected node, confirm the service is no longer exposed in the way the threat model assumes, and confirm that logs cover the exploitation window. Review authentication events, unusual administrative actions, unexpected child processes, and outbound connections from the Confluence host.

Decision rule: If you cannot verify that the instance stayed uncompromised, rotate any credentials, API keys, tokens, or service accounts that may have been accessible from the system and investigate adjacent systems for follow-on access. If the product cannot be restored safely, remove it rather than leave a known-exploited service online.

Practitioner takeaway: For actively exploited RCEs, the real decision is not patch versus no patch, it is how quickly you can remove reachability, prove remediation, and rule out earlier compromise.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org