All articles tagged with #confluence
A critical, unauthenticated file-access vulnerability in eight Atlassian Data Center products is being actively exploited. The flaw, CVE-2026-21589, allows attackers to read specific files in the web root if they know the exact path. In Crowd-integrated deployments, this can lead to full administrator takeover. Exploitation attempts began within two hours of a public proof-of-concept release.
Atlassian disclosed a critical vulnerability, CVE-2026-21589, affecting eight self-hosted Data Center products. The flaw allows unauthenticated attackers to read specific files in the web root if they know the exact path. While Atlassian initially reported no evidence of exploitation, security firms confirmed active attempts within hours of technical details emerging. Cloud users are patched, but self-hosted admins must update immediately or apply temporary mitigations.
A critical security flaw affecting Atlassian Confluence Data Center and Server has been actively exploited by malicious actors, with nearly 40,000 exploitation attempts recorded within three days of its public disclosure. Tracked as CVE-2023-22527, the vulnerability allows unauthenticated attackers to achieve remote code execution on susceptible installations. The exploitation attempts, originating from over 600 unique IP addresses, are currently limited to testing callback attempts and 'whoami' execution, indicating opportunistic scanning for vulnerable servers. Over 11,000 Atlassian instances have been found accessible over the internet, raising concerns about the extent of vulnerability.
Hackers are actively exploiting a critical remote code execution vulnerability, CVE-2023-22527, in outdated versions of Atlassian Confluence servers, with over 39,000 exploitation attempts recorded. The flaw allows unauthenticated remote attackers to execute code and affects versions 8.0.x to 8.5.3. Atlassian has released fixes for affected versions and advises administrators to update to secure versions released after December 5, 2023, while also recommending thorough system cleanup for potentially compromised instances.
Atlassian has raised the severity rating of a recent vulnerability in its Confluence Data Center and Server, increasing the CVSS score to the maximum of 10. The vulnerability allows an attacker to reset Confluence and create an administrator account, granting them extensive control over compromised instances. Active exploitation of the vulnerability has been reported, with attacks leading to the attempted deployment of the Cerber ransomware strain. Atlassian advises all Confluence users to upgrade immediately or apply temporary mitigations. The increased severity rating now matches that of another major Confluence vulnerability disclosed earlier in October.
A critical vulnerability in Atlassian's Confluence enterprise server app, known as CVE-2023-22518, is being actively exploited by threat actors, with attacks targeting Ukraine. The vulnerability allows for the execution of malicious commands and the restoration of databases. Security firms have observed the exploitation leading to ransomware deployment. Atlassian has urged customers to take immediate action to protect their instances, including patching or temporarily removing the server from the internet. Failure to address the vulnerability poses a significant risk of data loss.
Atlassian has issued a warning to administrators to immediately patch Internet-exposed instances of its Confluence software due to a critical security flaw that could result in data loss. The vulnerability, tracked as CVE-2023-22518, affects all versions of Confluence Data Center and Confluence Server software and poses a significant risk to publicly accessible instances. While the bug does not impact data confidentiality, it can be exploited by unauthorized attackers to destroy data on affected servers. Atlassian has released fixed versions of the software and advises administrators to upgrade or apply mitigation measures, including backing up unpatched instances and blocking Internet access.