CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-07-29. EPSS: 98.2% chance of exploitation in the next 30 days.

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

Affected products

• Atlassian Questions For Confluence: version 2.7.34 only; version 2.7.35 only; version 3.0.2 only

Published 2022-07-20. Last modified 2026-06-17.