CVE-2022-26134

CVE-2022-26134 is a critical software vulnerability that was discovered in Atlassian Confluence Server and Data Center. This flaw, which allows for remote code execution (RCE), was publicly disclosed by Atlassian in June 2022. The Cybersecurity and Infrastructure Security Agency (CISA) recognized the severity of this vulnerability and added it to their catalog of known exploited vulnerabilities shortly after its disclosure. The Peach Sandstorm Advanced Persistent Threat (APT) group has been observed attempting to exploit this vulnerability, among others, in order to gain initial access to targeted environments. The group has used CVE-2022-26134 as part of its ongoing campaign, exploiting it alongside other known vulnerabilities such as CVE-2022-47966, which affects Zoho ManageEngine products. These RCE vulnerabilities have been used as an alternate attack method to password spraying, allowing the group to remotely exploit vulnerable applications. This vulnerability, being the second most exploited, has had significant impacts on cybersecurity. It has been used not only by the Peach Sandstorm APT but also by other threat actors, including North Korea's Lazarus Group and an unknown group that targeted a U.S. aeronautical organization. The widespread exploitation of CVE-2022-26134 underscores the importance of timely patching and maintaining up-to-date security measures to protect against such threats.