Confluence zero-day: patch it or take it offline
Every supported Confluence Server and Data Center version can be taken over without a login. Act today.
Last Thursday Atlassian warned of a critical bug in Confluence Server and Data Center (CVE-2022-26134): anyone who can reach the site can run code on it, without logging in. It was already being exploited when it was announced. Fixed versions came out a day later.
Confluence often holds a company’s whole memory: procedures, passwords people shouldn’t have written down, network diagrams. And it’s often open to the internet so staff can reach it from home.
What to do:
- Upgrade to a fixed version now. Atlassian lists them per release line.
- If you can’t today, block internet access to it, or shut it down until you can. Atlassian said the same.
- Check for signs of compromise: new files in the web folders, unknown admin users, odd processes started by the Confluence service.
- Put it behind a VPN or access proxy afterwards, so the next bug isn’t reachable by the whole internet.
Atlassian Cloud customers aren’t affected. For self-hosted tools like this, the question is always the same: does it really need to face the internet?