Confluence OGNL Expression Injection for 2026-10-19

Oct 19, 2026 Exploitation

Last Updated: 00:00 UTC

OGNL (Object-Graph Navigation Language) expression injection in Atlassian Confluence achieving unauthenticated RCE. The URL-encoded prefix %24%7B%40java.lang (${@java.lang) is the invariant for CVE-2022-26134 and related injection variants. Active exploitation includes OOB DNS callback canaries via interactsh.

CVE References

CVE-2022-26134 CVE-2023-22515

MITRE ATT&CK

Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application

Observed URIs

Attackers by Country

Sweden: 3South Africa: 1Russia: 1
Sweden360.0%
South Africa120.0%
Russia120.0%

IP Address : ASN : City/Provider

Share on: