Multiple new critical vulnerabilities have been discovered affecting the Atlassian products. The first affected application, Confluence, is a web-based wiki application that allows organizations to share knowledge about internal products, it is often used in software engineering. On July 20, 2022, Atlassian warned of a vulnerability for the “Questions For Confluence” app, tracked as CVE-2022-26138, was “likely to be exploited in the wild” due to a Twitter user publicly disclosing a hardcoded password. The app, which acts as an extension to the Confluence product, creates its own account with users’ permissions. The underlying issue is the developers of the app decided to not use a unique password for each instance and instead hardcoded a globally used username and password combination. An attacker with knowledge of the hardcoded username and password credentials can log in to any Confluence instance with the app installed and access pages visible to the “confluence-users” group, potentially leaking company secrets and internal documents. The “Questions For Confluence” app is currently installed, and was likely vulnerable at the time of disclosure, on over 8,000 instances. Confluence administrators that manage a vulnerable instance must either disable or remove the app’s account, “disabledsystemuser”. On the same day, Atlassian released another advisory for two (2) other vulnerabilities, tracked as CVE-2022-26136 and CVE-2022-26137, that affect eight (8) Atlassian products. The vulnerabilities allow a remote unauthenticated attacker to bypass the “Servlet Filter,” a function that processes HTTP responses to and from a client device and often implements security mechanisms for the application. The first vulnerability allows authentication bypass through specially crafted HTTP requests as well as cross site scripting using a malicious URL. The second vulnerability allows attackers to invoke additional Servlet Filters, ultimately leading to a Cross-Origin Resource Sharing (CORS) bypass. An attacker exploiting a CORS bypass can trick users into visiting malicious URLs then access the vulnerable application using the victims’ permissions. Atlassian has released patches for both of these vulnerabilities across the affected products. CTIX analysts urge administrators of Atlassian products to ensure their applications are up to date and the weak app account is not exploitable by attackers.