Confluence Data Center
CVE-2025-22166
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySend crafted resource-intensive requests
-
ExploitTrigger asymmetric resource consumption (CWE-405)
-
ExecutionExhaust server CPU/memory/threads
-
ImpactConfluence service unavailable to users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Asymmetric resource consumption control
|
| Exploitation Conditions | Requires an authenticated low-privilege session (PR:L) against a network-reachable Confluence Data Center or Server instance running an affected version (introduced in 2.0; anything below 8.5.25, 9.2.7, or 10.0.2). No user interaction is needed (UI:N) and default configurations are affected - there is no special feature or config gate beyond having valid low-privilege credentials. The authentication requirement is the primary limiting factor, meaning unauthenticated internet attackers cannot exploit it directly; risk is elevated for instances allowing self-registration, having many low-trust user accounts, or exposed to broad user populations. |
| Impact | This is a genuine but moderate-priority availability risk, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity attack, but PR:L means the attacker must be authenticated - a meaningful gate that excludes anonymous internet scanners. Impact is availability-only (VA:H/SA:H, with VC:N/VI:N), consistent with CWE-405 (asymmetric resource consumption / resource exhaustion) and the DoS description; there is no confidentiality or integrity exposure. EPSS is 0.51% (41st percentile) - modest, indicating no strong signal of imminent mass exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so the '8.3 HIGH' score is driven by the severity of full service disruption on a widely deployed collaboration platform rather than by evidence of active abuse. Note the vendor's SA:H (subsequent-system availability) is somewhat generous for a single-instance DoS; a conservative CVSS 3.1 mapping lands closer to ~6.5 (A:H only). Bottom line: patch on a normal-but-prompt cycle, prioritizing internet-exposed or multi-tenant Confluence instances, rather than treating it as a drop-everything zero-day. |
| Exploit ScenarioDerived | An attacker with any valid low-privilege Confluence account (or credentials obtained via phishing/reuse) sends specially crafted requests to a network-reachable Confluence Data Center/Server instance that trigger disproportionate resource consumption. The server's CPU, memory, or thread/connection pools are exhausted, rendering the wiki temporarily or indefinitely unavailable to legitimate users. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
A denial-of-service vulnerability in Atlassian Confluence Data Center and Confluence Server allows an authenticated, low-privilege user to exhaust server resources and make the instance unavailable to its intended users, with no user interaction required. The flaw was introduced in Confluence 2.0 and affects all releases below the fixed versions 8.5.25 (8.5 branch), 9.2.7 (9.2 branch), and 10.0.2 (10.0 branch); the CVSS 4.0 score of 8.3 reflects high availability impact at both the vulnerable and subsequent system level. EPSS is low at roughly 0.51% (41st percentile) and no public exploit code has been identified at time of analysis, but the authentication requirement is the primary limiting factor - risk is elevated for instances that permit self-registration, host large populations of low-trust accounts, or are otherwise exposed to broad user bases. This is a genuine but moderate-priority availability risk, not a critical emergency.
RemediationAI
Vendor-released patch: upgrade to Confluence Data Center and Server 8.5.25 or later on the 8.5 branch, 9.2.7 or later on the 9.2 branch, or 10.0.2 or later on the 10.0 branch, or to the latest generally available release from the Atlassian download center (https://www.atlassian.com/software/confluence/download-archives); full details are in the Atlassian advisory (https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034) and CONFSERVER-100907 (https://jira.atlassian.com/browse/CONFSERVER-100907). Because a patch is available, there is no need to rely on compensating controls, but until maintenance windows allow the upgrade, the practical mitigations follow directly from the PR:L prerequisite. First, restrict and audit who holds accounts: disable public self-registration in Confluence (Administration > User Management > Signup options), since open registration lets an outsider obtain the low-privilege session the attack needs; the trade-off is that legitimate new users must be provisioned manually. Second, review and minimize 'can use' and anonymous-access permissions for large or untrusted user groups, and remove dormant or guest accounts, accepting the administrative overhead of tighter account hygiene. Third, place the instance behind a reverse proxy or WAF and rate-limit request volume per authenticated session (for example with nginx limit_req or an equivalent rule set), which can blunt amplification loops but risks throttling legitimate heavy users and cannot reliably distinguish malicious from benign traffic without tuning. Fourth, apply network controls so the instance is only reachable from trusted networks or via VPN rather than the open internet, and enable JVM heap monitoring with automated restart/alerting so an exhaustion attempt surfaces quickly; restricting reachability reduces exposure but is impractical for externally facing collaboration deployments, and monitoring is detective rather than preventive. None of these fully substitute for upgrading to a fixed release.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-405 (Asymmetric Resource Consumption / Amplification), meaning a comparatively small, cheap request from the attacker triggers disproportionately expensive server-side work - typically unbounded allocation, expensive computation, or amplification of a query or rendering operation. The affected technology is Atlassian Confluence, the Java-based enterprise wiki and collaboration platform, deployed either as Data Center (clustered, self-managed) or Server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H) confirms the attacker needs only network reachability plus a valid low-privilege account (PR:L), that no user interaction or special attack conditions are needed (UI:N, AT:N), and that no confidentiality or integrity impact occurs - only availability, and notably also on subsequent systems (SA:H), consistent with shared cluster/host resource exhaustion. The independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Because exploitation requires only a legitimate authenticated session rather than administrative privileges, any account able to reach the affected endpoint is a potential vector; the CPE data listing both atlassian:confluence_data_center and atlassian:confluence_server across multiple version ranges confirms both deployment forms are in scope, and the description notes the defect dates back to version 2.0, so a very wide range of historical releases is potentially affected.
Know when Confluence Data Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Network-reachable, low-complexity, but requires a low-privilege authenticated account (PR:L); impact is availability-only DoS (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (atlassian).
CVSS VectorVendor: atlassian
DescriptionCVE.org
This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.
This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.
Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2
See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).
This vulnerability was reported via our Atlassian (Internal) program.
Executive ViewAI
Atlassian Confluence Data Center and Confluence Server are affected by a denial-of-service flaw that lets a user with an existing account consume server resources until the instance becomes unavailable to everyone who depends on it, with the affected code tracing back to Confluence 2.0 and fixed versions identified as 8.5.25, 9.2.7, and 10.0.2. Risk is concentrated on instances that allow self-registration or host large populations of low-trust accounts, because a single ordinary account is sufficient and no user interaction is required. Because Confluence is a shared documentation and collaboration platform, an outage disrupts engineering, support, and business workflows organization-wide rather than affecting one team, so leadership should treat this as a moderate-priority availability risk rather than a critical emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Confluence Data Center
View allAll versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. Rated high severity
The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza
This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. Rated high s
This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center
This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center a
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject u
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of
GitHub PoC
Exploit-DB