Secuno
ENNL
Book demo

CVE-2022-26138

Atlassian Questions For Confluence App Hard-coded Credentials

9.8 CRITICALActively exploited (CISA KEV)EPSS 98.2%
  1. Published20 Jul 2022
  2. Added to CISA KEV29 Jul 2022
  3. Remediation due19 Aug 2022
Actively exploited (CISA KEV)

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

Added to KEV: 29 Jul 2022Federal remediation due: 19 Aug 2022

Description

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Atlassian Questions For Confluence2.7.34 · 2.7.35 · 3.0.2

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1095669.8
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability…
CVE-2026-1087539.4
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in…
CVE-2026-1052789.8
The published Docker image for openPDC includes a fixed administrative credential with…
CVE-2026-842508.4
IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection…
CVE-2026-622529.8
Homer is open source telecom observability software. Prior to version 11.0.283, on…
CVE-2026-1021618.8
An unauthenticated attacker located on an adjacent private network (or any attacker…

Frequently asked

Is CVE-2022-26138 being actively exploited?

Yes. CVE-2022-26138 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 29 Jul 2022.

How severe is CVE-2022-26138?

CVE-2022-26138 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 98.2% probability of exploitation.

Which products are affected by CVE-2022-26138?

Affected products include Atlassian Questions For Confluence.

How do I fix CVE-2022-26138?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-26138 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.