Cloudflare customers are protected from the Atlassian Confluence CVE-2022-26134
Jun 3, 2022Reid Tatoris, Daniel Stinson-Diess, Sourov Zaman, Vaibhav Singhal
Summary
This post details the emergency release of a WAF rule (IDs 100531 and 408cff2b) to mitigate CVE-2022-26134, a critical RCE vulnerability in Atlassian Confluence. It explains that Cloudflare customers using WAF or Access are already protected. The WAF rule was deployed on June 2, 2022, at 23:38 UTC with a default BLOCK action. It also highlights that Cloudflare Access protects against unauthenticated exploitation attempts by verifying user authentication before requests reach the Confluence server.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack