Security readout for executives and security teams
Plain-English summary
Affected Atlassian Questions for Confluence app versions create a Confluence user named disabledsystemuser with a hardcoded password. A remote unauthenticated attacker who knows that password can log in and read content available to the confluence-users group, which may include sensitive internal documentation.
Executive priority
Handle as an urgent credential-exposure issue. Confirm affected Confluence instances, follow Atlassian remediation, and investigate for use of the created account, especially on internet-facing systems.
Technical view
CVE-2022-26138 is CWE-798 in Atlassian Questions for Confluence 2.7.34, 2.7.35, and 3.0.2 for Confluence Server and Data Center. The app creates disabledsystemuser in confluence-users with a hardcoded password, enabling network login without prior privileges when the password is known.
Likely exposure
Exposure is limited to Confluence Server or Data Center instances with the affected Questions for Confluence app versions installed. Impact depends on what confluence-users can access.
Exploitation context
CISA lists CVE-2022-26138 in the Known Exploited Vulnerabilities catalog, so treat exploitation as confirmed. The source bundle does not provide exploit details, timing, or observed attacker behavior.
Researcher notes
The strongest evidence is Atlassian’s advisory and CVE description, plus CISA KEV status. Sources do not include a safe fixed version in the prompt, so remediation should be verified against Atlassian guidance.
Mitigation direction
- Identify whether Questions for Confluence versions 2.7.34, 2.7.35, or 3.0.2 are installed.
- Follow Atlassian’s advisory for supported remediation or upgrade guidance.
- Review and restrict confluence-users access to sensitive spaces where practical.
- Check for the disabledsystemuser account and handle it per vendor guidance.
- Prioritize internet-exposed Confluence instances first.
Validation and detection
- Inventory Confluence Server and Data Center instances for Questions for Confluence.
- Confirm the installed app version on each instance.
- Check whether disabledsystemuser exists in Confluence users.
- Review confluence-users group permissions for sensitive content exposure.
- Look for successful logins by disabledsystemuser in authentication logs.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-798: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-26138 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.atlassian.com/browse/CONFSERVER-79483CVE reference · x_refsource_MISC
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.htmlCVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Hard-coded Credentials
Use of Hard-coded Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.