Security researchers have observed active exploitation attempts of a critical vulnerability in certain outdated versions of Atlassian Confluence server. This flaw, tracked as CVE-2023-22527, is a template injection remote code execution vulnerability affecting versions released before December 5, 2023, and allows unauthenticated remote attackers to execute code on vulnerable Confluence Data Center and Server endpoints. Researchers have tracked over 39,000 exploitation attempts, primarily from Russian IP addresses, and identified more than 11,000 Confluence instances accessible online, though not all are vulnerable. Attackers have been observed using the ‘whoami’ command for reconnaissance. Atlassian has not provided specific indicators of compromise for CVE-2023-22527, advising administrators to update Confluence servers to post-December 5, 2023, versions and treat outdated instances as potentially compromised. CTIX analysts recommend that any administrators responsible for instances of Atlassian Confluence server ensure that they have upgraded to the most recent software version to prevent exploitation.