The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Federal Bureau of Investigation (FBI) are all urging network administrators across the public and private sectors to immediately patch an actively exploited critical vulnerability affecting Atlassian Confluence servers that are publicly exposed to the internet. The flaw, tracked as CVE-2023-22515, is a privilege escalation vulnerability impacting instances of Atlassian’s Confluence Data Center and Server 8.0.0 and later. The flaw is remotely exploitable and requires no user interaction for the threat actor to successfully conduct the attack. If successfully exploited, threat actors could create administrator accounts, giving them complete control over the vulnerable servers. Exploitation of this flaw was first recognized in mid-September 2023 and was subsequently patched on October 4, 2023. Entities who simply could not apply the patches due to the impact a shutdown would have on critical business processes were urged to isolate their instances from the internet or completely shut them down. Some exploitation has been specifically attributed to the Chinese state-sponsored threat actor tracked by Microsoft as Storm-0062 (otherwise known as DarkShadow or Oro0lxy), who have been exploiting this flaw since at least September 14, 2023. Although the vulnerability is currently not under mass exploitation, that could quickly change in the near future as technical details about the vulnerability itself and working proof-of-concept (PoC) exploits are being released to the public. The instructions for exploitation, coupled with the low complexity of the attack, means that even unsophisticated attackers may attempt exploitation. The flaw was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, mandating that all Federal Civilian Executive Branch (FCEB) agencies had to patch the vulnerability by no later than October 13, 2023. The agencies urge all network administrators responsible for maintaining these servers to ensure they are running up to date software and conduct internal investigations for any indication that they may have already been exploited. Indicators of compromise (IOCs) for exploitation can be found in the CISA advisory linked below.