CVE-2025-22166

Estado: AnalizadaAlta (8.3)—

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2

Leer descripción completaMostrar menos

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Atlassian (Internal) program.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.51%
Percentil entre todas las CVEs puntuadas: 41
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1499 Endpoint Denial of Serviceimpact85 %

AV:N/PR:L indica explotación remota con privs; DoS explícito en descripción (T1499). CWE-405 (capacidad no validada) sustenta negación de servicio remota.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Filter Network Traffic Disable or Remove Feature or Program

Tecnologías afectadas (2)

Atlassian — Confluence Data Center Atlassian — Confluence Server

CWE

CWE-405

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-22166",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22166",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-21T16:21:21.142041Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@atlassian.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Confluence Data Center",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 to 9.5.4"
            },
            {
              "status": "affected",
              "version": "9.4.0 to 9.4.1"
            },
            {
              "status": "affected",
              "version": "9.3.1 to 9.3.2"
            },
            {
              "status": "affected",
              "version": "9.2.0 to 9.2.6"
            },
            {
              "status": "affected",
              "version": "9.1.0 to 9.1.1"
            },
            {
              "status": "affected",
              "version": "9.0.1 to 9.0.3"
            },
            {
              "status": "affected",
              "version": "8.9.0 to 8.9.8"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1"
            },
            {
              "status": "affected",
              "version": "8.7.1 to 8.7.2"
            },
            {
              "status": "affected",
              "version": "8.6.1 to 8.6.2"
            },
            {
              "status": "affected",
              "version": "8.5.3 to 8.5.24"
            },
            {
              "status": "affected",
              "version": "7.19.16 to 7.19.30"
            },
            {
              "status": "unaffected",
              "version": "10.0.2 to 10.0.3"
            },
            {
              "status": "unaffected",
              "version": "9.2.7 to 9.2.9"
            },
            {
              "status": "unaffected",
              "version": "8.5.25 to 8.5.27"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-10-21T16:15:37.370",
  "references": [
    {
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-100907",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-405"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7\r\n Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad DoS (denegación de servicio) de alta gravedad fue introducida en la versión 2.0 de Confluence Data Center.\n\nEsta vulnerabilidad DoS (denegación de servicio), con una puntuación CVSS de 8.3, permite a un atacante causar que un recurso no esté disponible para sus usuarios previstos al interrumpir temporal o indefinidamente los servicios de un host conectado a una red.\n\nAtlassian recomienda que los clientes de Confluence Data Center actualicen a la última versión; si no pueden hacerlo, actualicen su instancia a una de las versiones fijas compatibles especificadas:\n Confluence Data Center y Server 8.5: Actualizar a una versión mayor o igual a 8.5.25\n Confluence Data Center y Server 9.2: Actualizar a una versión mayor o igual a 9.2.7\n Confluence Data Center y Server 10.0: Actualizar a una versión mayor o igual a 10.0.2\n\nConsulte las notas de la versión ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). Puede descargar la última versión de Confluence Data Center desde el centro de descargas ([https://www.atlassian.com/software/confluence/download-archives]).\n\nEsta vulnerabilidad fue reportada a través de nuestro programa Atlassian (Interno)."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D558D1C-94B1-4F03-B25D-5C9572ACD9D2",
              "versionEndExcluding": "8.5.25",
              "versionStartIncluding": "8.5.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEEEF74E-9B32-4CA0-B892-C5559B44F031",
              "versionEndExcluding": "9.2.7",
              "versionStartIncluding": "9.2.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46B5C105-6E80-4CE7-9928-8C0C6321E94E",
              "versionEndExcluding": "10.0.2",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8BA896B-97EF-4D11-82F8-BBCADE5DAE45",
              "versionEndExcluding": "8.5.25",
              "versionStartIncluding": "8.5.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CFF1E61-C6D4-4699-AD54-C8C7F4D1282F",
              "versionEndExcluding": "9.2.7",
              "versionStartIncluding": "9.2.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "100D4CEB-7E91-4046-82D7-1BBF48EFB7E1",
              "versionEndExcluding": "10.0.2",
              "versionStartIncluding": "10.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}