CVE-2019-3396: Atlassian Confluence Widget Connector template injection, unauthenticated RCE
The short version: CVE-2019-3396 is a server-side template injection flaw in the Widget Connector macro of Atlassian Confluence Server and Data Center. An unauthenticated attacker can use it to achieve path traversal and remote code execution on the server. It scores 9.8, it's in CISA's KEV catalog, and it was leveraged to deliver GandCrab ransomware. If you run an old self-hosted Confluence, patch and verify. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 99.91% · 99.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — used in ransomware campaigns (GandCrab) |
| Vulnerability type | CWE-22 path traversal via server-side template injection → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Confluence Server & Data Center: before 6.6.12; 6.7.0–6.12.2; 6.13.0–6.13.2; 6.14.0–6.14.1 |
| Fixed in | 6.6.12 · 6.12.3 · 6.13.3 · 6.14.2 (and later) |
What you need to know
The Widget Connector macro mishandled input in a way that let an attacker inject a server-side template, achieving path traversal and remote code execution without authenticating. In plain terms, a crafted request lets a stranger read files off the server and run their own code on it.
- It's unauthenticated and internet-reachable. Confluence is usually exposed for remote collaboration — no login, no chain.
- It was weaponized fast. Public proof-of-concept and a Metasploit module followed disclosure, and criminal actors used it to deploy ransomware; both APT and criminal exploitation were reported.
How serious we see it
High — the 9.8 is accurate.
Unauthenticated code execution on an internet-facing content server, with confirmed ransomware use, is top-of-queue by any measure. The bounded, reassuring part: it only affects older Confluence builds, the fixes have long been available, and exposure is quick to confirm. If you're on a current release you're clear — but any instance left on a vulnerable build this long should be checked for prior compromise, not just patched.
Recommendations
Straight from Atlassian's advisory and CISA:
- Patch now. Upgrade to 6.6.12 / 6.12.3 / 6.13.3 / 6.14.2 or later — ideally to a current supported release.
- Hunt for prior use. Given the age and ransomware history, review logs and the host for web shells, miners, and ransomware artifacts.
- If compromised, respond fully. Rebuild the host and rotate credentials and secrets it could reach.
- Harden exposure. Restrict who can reach Confluence from the internet.
- Confirm your exposure first. Verify whether you run an affected self-hosted Confluence build.
How BreachRisk sees it
BreachRisk discovers internet-facing Confluence from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top because it's in KEV. We detect and flag the vulnerable version; we don't exploit it.
A forgotten, out-of-date Confluence server is exactly the kind of asset an attacker finds first. The continuous outside-in view surfaces it as a ranked finding before it becomes someone's entry point.