Confluence CVE-2023-22515 / 22518: When Internal Wikis Become Ransomware Targets

Last updated: April 26, 2026

Atlassian Confluence Data Center / Server had two critical CVEs in late 2023 — CVE-2023-22515 (broken access control in setup endpoints) and CVE-2023-22518 (privilege escalation via XML import). Mass-exploited by ransomware operators including BlackCat / ALPHV. This article covers the bugs, the IoCs, and why on-prem Atlassian remains a high-priority attack surface in 2026.

The vulnerabilities

CVE-2023-22515 (Broken Access Control)

The Confluence setup endpoint /setup/setupadministrator.action remained accessible after initial setup completed. Unauthenticated attackers could create new administrator accounts on running Confluence instances by re-triggering the setup flow.

POST /setup/setupadministrator.action HTTP/1.1
Host: target
X-Atlassian-Token: no-check

userName=evilAdmin&fullName=evil&email=evil@evil&password=Evil@2026&confirmPassword=Evil@2026

One request, new admin account. Two clicks, full Confluence content access.

CVE-2023-22518 (XML Import Privilege Escalation)

Authenticated user (or attacker via 22515-created admin) could import a crafted XML site export, abusing the import logic to escalate to system-level operations on the Confluence server.

Why mass-exploitation happened

• Confluence on-prem is widely deployed in Indian enterprise (alternative to cloud Confluence for data-residency reasons)
• Internal Confluence often holds sensitive data — internal docs, source code excerpts, credentials in pages, customer-data references
• Confluence + Jira combination means lateral access from one to the other
• Ransomware operators specifically targeted Confluence as an exfiltration source

IoCs

• HTTP requests to /setup/setupadministrator.action on a long-running Confluence instance
• New administrator accounts created outside change-control windows
• Audit log gaps if attacker disabled audit logging
• Anomalous file uploads to /var/atlassian/application-data/confluence/
• External access to Confluence from new IPs with admin-level activity

Mitigation

1. Patch Confluence to latest version. Atlassian publishes monthly security bulletins; subscribe.
2. Block /setup/* endpoints at WAF / reverse proxy after initial setup.
3. Restrict Confluence admin interface to internal networks only — never public internet.
4. MFA on all Confluence administrator accounts.
5. Audit existing administrator accounts; document each.
6. Forward Confluence audit logs to SIEM.

Why on-prem Atlassian persists

Atlassian announced end-of-life for Confluence Server (the standalone version) in 2024. Customers migrate to Confluence Cloud or Confluence Data Center (the larger / clustered version). Both moves are slow:

• Cloud — concerns about data residency, compliance, integration disruption
• Data Center — significant licensing cost increase

Many Indian enterprises with Confluence Server are still in transition through 2026. They face: end-of-life software, no security patches, and no cloud-migration timeline. This is the worst of both worlds.

The strategic answer

• Migrate to Confluence Cloud or Data Center on a defined timeline
• For organisations that cannot, replace Atlassian with alternatives — GitHub-Enterprise wikis, Notion, Slab, BookStack, Outline. Each has a migration path
• For interim period: lock down Confluence Server tightly — internal-only access, MFA, network segmentation, weekly vulnerability scanning

Compliance angle

• End-of-life software in production is a finding under most compliance frameworks (ISO, SOC 2, RBI)
• DPDP §8(5) — vulnerable Confluence holding personal data is a defensible-security failure
• SEBI CSCRF — application security testing must include Confluence

The takeaway

Confluence is the unglamorous attack surface — internal documentation tool that happens to hold massive amounts of valuable data. The 2023 CVEs showed how aggressively ransomware operators target it. If you run Confluence on-prem in 2026, you need an active migration plan, internal-only network restriction, and weekly patching cadence. The data inside Confluence is often more sensitive than the access controls suggest.