Background / What has happened?
On June 3 2022, Atlassian published a regarding a critical unauthenticated remote code execution (RCE) vulnerability (CVE-2022-26134) in all supported versions of Atlassian Confluence Server and Data Center.
Exploitation of this RCE vulnerability could allow a malicious actor to remotely install malware or otherwise control the affected device without authentication.
The ACSC is aware of malicious actors successfully exploiting the vulnerability prior to , however at this time the ACSC is not aware of successful exploitation within Australia.
Mitigation / How do I stay secure?
At the time of writing, there is no patch available.
As an interim mitigation (until a patch is available) the ACSC advises that organisations restrict direct internet access to and from vulnerable devices. Remote access to these devices should be limited to authenticated users within corporate intranets.
The ACSC recommends Atlassian Confluence Server and Data Center users continue to monitor the for updates as well as future vulnerabilities.
