CVE-2023-22527: Atlassian Confluence template injection to unauthenticated RCE, actively exploited
The short version: Out-of-date versions of Atlassian Confluence Data Center and Server have a template-injection flaw (CVE-2023-22527) that lets an unauthenticated attacker execute code on the instance. It's in CISA's KEV catalog, tied to known ransomware use, and saw thousands of exploitation attempts. There are no workarounds — patch to a fixed version. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, actively exploited, ransomware-associated |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.98% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-02-14 |
| Known exploited? | Yes — mass exploitation attempts; CISA notes known ransomware campaign use |
| Vulnerability type | CWE-74 injection (OGNL template injection) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication (works without anonymous access enabled) |
| Affected | Confluence Data Center & Server 8.0.x–8.5.3 (and 8.4.5, which no longer receives backported fixes) |
| Fixed in | 8.5.4 (LTS) and later; Data Center 8.6.0+ / 8.7.1+ |
What you need to know
CVE-2023-22527 is a template-injection flaw in older Confluence Data Center and Server. A crafted request reaches the template engine and executes attacker-supplied expressions, yielding remote code execution on the instance. No authentication is required, and — importantly — it works without anonymous access enabled, so restricting anonymous permissions does not close it.
Why it's top-of-queue:
- It's pre-authentication and internet-reachable. Confluence is frequently exposed for remote collaboration.
- It was hit hard and fast. Researchers observed hundreds of source IPs launching thousands of exploitation attempts, and CISA lists it as exploited with known ransomware use.
- There are no workarounds. Atlassian is explicit — patching is the remediation; blocking anonymous access is not enough.
How serious we see it
High — the 9.8 holds up.
Unauthenticated, network-reachable remote code execution on a widely deployed collaboration platform, mass-exploited and tied to ransomware, is textbook top-of-queue. The bounded, reassuring part: it affects a specific range of out-of-date versions, the fixes are published, and Atlassian Cloud sites (accessed via atlassian.net) are not affected. The catch is the usual one for an actively exploited flaw — patch, but also determine whether you were reached before you did.
Recommendations
Straight from Atlassian's advisory and CISA:
- Patch now. Upgrade to a fixed version — 8.5.4 (LTS) or later, or Data Center 8.6.0+ / 8.7.1+. There are no workarounds.
- Don't rely on disabling anonymous access. The flaw is exploitable without it.
- Hunt for prior use. Review logs for suspicious requests to template/OGNL-handling endpoints and unexpected child processes.
- If you find indicators, respond. Rebuild where warranted and rotate credentials, tokens, and secrets on the instance.
- Confirm your exposure first. Verify whether you run an internet-facing Confluence Data Center/Server in the affected range.
How BreachRisk sees it
BreachRisk discovers internet-facing Confluence Data Center and Server instances from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV and because our severity take reflects the real-world, ransomware-associated impact.
That continuous, attacker's-eye view is exactly what a mass-exploited Confluence RCE calls for: the exposed instance is already mapped, so you go straight to patch-and-verify instead of racing an automated scan.