Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518

Daniel Lydon and Conor Quinn contributed attacker behavior insights to this blog.

As of November 5, 2023, Rapid7 Managed Detection and Response (MDR) is observing exploitation of Atlassian Confluence in multiple customer environments, including for ransomware deployment. We have confirmed that at least some of the exploits are targeting CVE-2023-22518

atlassian atlassian confluence attacker blog confluence contributed customer cve cve-2023-22518 daniel deployment detection detection and response emergent threat response environments exploitation exploits insights managed managed detection managed detection and response mdr november ransomware rapid7 response targeting vulnerability risk management