Loading story…
Attackers rapidly began exploiting CVE-2023-22527, a critical CVSS 10.0 remote code execution flaw in Atlassian Confluence Data Center and Confluence Server, within days of public disclosure. The vulnerability affects outdated Confluence 8 releases issued before December 5, 2023, as well as version 8.4.5, and stems from OGNL expression injection that can let unauthenticated attackers execute arbitrary code on exposed servers.
Telemetry from Shadowserver Foundation and The DFIR Report recorded nearly 40,000 exploitation attempts over three days from more than 600 unique IP addresses, indicating broad opportunistic scanning across the internet. Observed activity included callback testing and basic reconnaissance such as running whoami, suggesting attackers were validating access for potential follow-on compromise; at the time, more than 11,000 Atlassian instances were internet-accessible, underscoring the exposure risk for unpatched organizations.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
As of January 21, 2024, more than 11,000 Atlassian instances were accessible over the internet. The number of those instances actually vulnerable to CVE-2023-22527 was not known.
Attackers began actively exploiting CVE-2023-22527 within three days of its public disclosure. Shadowserver Foundation and The DFIR Report observed exploitation attempts starting as early as January 19, 2024.
ProjectDiscovery researchers Rahul Maini and Harsh Jaiswal published a technical analysis explaining that CVE-2023-22527 allows unauthenticated OGNL expression injection in Confluence. Their write-up described how the issue can be used to execute arbitrary code and system commands on affected systems.
Researchers recorded nearly 40,000 attempts to exploit CVE-2023-22527 from more than 600 unique IP addresses. The activity mainly involved callback testing and running the command 'whoami,' suggesting broad opportunistic scanning for vulnerable servers.
CVE-2023-22527 was publicly disclosed as a critical unauthenticated remote code execution flaw affecting Atlassian Confluence Data Center and Server, including 8.x releases issued before December 5, 2023 and version 8.4.5. The flaw enables OGNL expression injection that can lead to arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian released fixes for **CVE-2023-22527**, a critical template-injection vulnerability in Confluence Data Center and Confluence Server that enables an unauthenticated attacker to execute arbitrary code remotely. The flaw has a CVSS score of **10.0**, affects Confluence 8.0.x through 8.4.x and 8.5.0 through 8.5.3, and public proof-of-concept exploit code is available; internet-exposed instances face the greatest risk. Organizations should immediately upgrade affected deployments to Confluence 8.5.4, 8.6.0, or 8.7.1 as applicable, and apply Atlassian’s associated security mitigations. The Dutch NCSC assessed the issue as High/High for exploitation likelihood and impact, underscoring the need to identify exposed vulnerable servers, patch them urgently, and review systems for signs of compromise.
Aug 31, 2026
Attackers actively exploited **Atlassian Confluence** vulnerability `CVE-2022-26134`, a critical unauthenticated remote code execution flaw caused by **OGNL injection**, against on-premises Confluence Server and Data Center systems. Volexity first reported in-the-wild exploitation, and Atlassian confirmed that all supported self-managed versions prior to patched releases were affected, while **Atlassian Cloud was not vulnerable**. Atlassian issued fixed versions including `7.4.17`, `7.13.7`, `7.14.3`, `7.15.2`, `7.16.4`, `7.17.4`, and `7.18.1`, and also published temporary mitigation steps for organizations unable to patch immediately. Follow-on attacks used the exploit’s in-memory shell to deliver a wide range of payloads on both Linux and Windows servers, including **Gafgyt/Mirai-like botnets**, **Monero cryptominers**, **z0miner**, **Cobalt Strike shellcode**, web shells, and a malicious Linux package dubbed **pwnkit**. Sophos also observed attempts to deploy **Cerber ransomware** on Windows systems using `curl` and encoded PowerShell to fetch a payload from the `%temp%` directory, while Barracuda reported sustained exploitation months after disclosure, with automated reconnaissance, architecture-specific malware downloaders, and some malicious infrastructure remaining online for extended periods.
Aug 15, 2026
Atlassian published security advisory `AV26-731` covering multiple vulnerabilities, including some rated **critical**, across a broad set of products used in data center, server, and desktop environments. Affected product lines named in follow-on notices include **Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, Jira Service Management, and Sourcetree** for Mac and Windows, and government guidance urged administrators to review the advisories and apply vendor updates. One of the disclosed issues, `CVE-2026-21579`, is a high-severity **information disclosure** flaw in **Atlassian Confluence Data Center** with a CVSS 4.0 score of **8.2**. Atlassian said the vulnerability can be exploited remotely by an **unauthenticated** attacker to access sensitive information, affects multiple Confluence Data Center release lines, and is fixed in supported versions including **9.2.22 or later** and **10.2.14 or later**; customers were advised to upgrade to the latest or patched supported releases.
Jul 24, 2026