Read the docs
TI-2025-16102 Aliases CVE-2025-22166GHSA-879m-mhmf-vg5r

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of…

Priority LOW 37CWE-405Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Atlassian (Internal) program.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix Fixed Confluence Data Center (Atlassian): 10.0.2 to 10.0.3, 9.2.7 to 9.2.9, 8.5.25 to 8.5.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianConfluence Data Center9.5.1 to 9.5.4; 9.4.0 to 9.4.1; 9.3.1 to 9.3.2; 9.2.0 to 9.2.6; 9.1.0 to 9.1.1; 9.0.1 to 9.0.3; 8.9.0 to 8.9.8; 8.8.0 to 8.8.1; 8.7.1 to 8.7.2; 8.6.1 to 8.6.2; 8.5.3 to 8.5.24; 7.19.16 to 7.19.3010.0.2 to 10.0.3, 9.2.7 to 9.2.9, 8.5.25 to 8.5.27Patch availableCNA
  • Confluence Data Center VendorAtlassian Affected 9.5.1 to 9.5.4; 9.4.0 to 9.4.1; 9.3.1 to 9.3.2; 9.2.0 to 9.2.6; 9.1.0 to 9.1.1; 9.0.1 to 9.0.3; 8.9.0 to 8.9.8; 8.8.0 to 8.8.1; 8.7.1 to 8.7.2; 8.6.1 to 8.6.2; 8.5.3 to 8.5.24; 7.19.16 to 7.19.30 Fixed in 10.0.2 to 10.0.3, 9.2.7 to 9.2.9, 8.5.25 to 8.5.27 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*8.5.0 to before 8.5.25; 9.2.0 to before 9.2.7; 10.0.0 to before 10.0.2VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*8.5.0 to before 8.5.25; 9.2.0 to before 9.2.7; 10.0.0 to before 10.0.2VulnerableAtlassian
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions 8.5.0 to before 8.5.25; 9.2.0 to before 9.2.7; 10.0.0 to before 10.0.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions 8.5.0 to before 8.5.25; 9.2.0 to before 9.2.7; 10.0.0 to before 10.0.2 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Confluence Data Center (Atlassian) Fixed in 10.0.2 to 10.0.3, 9.2.7 to 9.2.9, 8.5.25 to 8.5.27

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22166
  2. 2026-10-03 Alias added: GHSA-879m-mhmf-vg5r

References

Advisory 2

  • TI-2023-08765 Injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-08757 Improper input validation in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09596 Expression language injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-08036 Expression language injection in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2023-08759 Incorrect authorization in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences