Are you responsible for any Confluence Server or Data Center instances? (CVE-2022-26134)

[#1]

Hello Enterprise community!

Are you responsible for any Confluence Server or Data Center instances?

If yes, update your Confluence instance to a patched version, or perform any of the remediation steps in Atlassian's recent Security Advisory, Confluence Security Advisory 2022-06-02. There's a summary of the exploit, and Atlassian has been updating the advisory for the last few days.

• ✉️ Pro-Tip: If you did not get an email for this advisory and want to receive such emails in the future, go to https://my.atlassian.com/email and subscribe to Alerts emails.

This issue is serious enough to bear repeating, and I know there are a large number of admins in this Enterprise group.

This zero-day attack is actively being exploited across the internet. Ars Technica also posted an article about it.

[Dave Liao]

Hopefully you're not responsible for any Confluence on-prem instances, or you've already performed the necessary updates / mitigation steps.

In that case, are you diving into Pokemon Go's 2022 Fest? 😅

[Ollie Guan]

Fixed! tks @Dave Liao 

[Taranjeet Singh]

Thank you for sharing this in the group, @Dave Liao !

I was performing a Jira Server to Cloud migration when the linked Confluence Server instance was hit by this security vulnerability and attack. Fortunately, bringing down the Confluence Host server (which also was running Crowd Server) did not have any impact on my migration, though I was not able to login to Jira Server for 5 minutes when Confluence host was being bounced.