Critical Atlassian Confluence RCE Hit by Mass Internet Exploitation
Active Exploitation · 2 sources · Updated 3mo ago · First seen Jan 21, 2024
Attackers rapidly began exploiting CVE-2023-22527, a critical CVSS 10.0 remote code execution flaw in Atlassian Confluence Data Center and Confluence Server, within days of public disclosure. The vulnerability affects outdated Confluence 8 releases issued before December 5, 2023, as well as version 8.4.5, and stems from OGNL expression injection that can let unauthenticated attackers execute arbitrary code on exposed servers.
Telemetry from Shadowserver Foundation and The DFIR Report recorded nearly 40,000 exploitation attempts over three days from more than 600 unique IP addresses, indicating broad opportunistic scanning across the internet. Observed activity included callback testing and basic reconnaissance such as running whoami, suggesting attackers were validating access for potential follow-on compromise; at the time, more than 11,000 Atlassian instances were internet-accessible, underscoring the exposure risk for unpatched organizations.
