Contextualize Prioritize and ACT ON RISK
Login
Get Access
Demo

blog

Critical Vulnerabilities in Atlassian Confluence: Zero-Day Exploits targeting CVE-2023-21715, Application Security, and Nation-State Threats

Atlassian Confluence Critical Vulnerability Zero-Day Exploit Application Security Nation-State CVE-2023-22515 Vulnerable Versions Security Patch Data Center Server
Atlassian Confluence Critical Vulnerability Zero-Day Exploit Application Security Nation-State CVE-2023-22515 Security Patch Data Center Server

Atlassian Confluence is a cornerstone for every developer; CISA has recently announced that Confluence, a popular tool for documentation and application security, has recently been under the spotlight due to a series of critical vulnerabilities CVE-2023-21715 in particular. With nation-state actors increasingly exploiting zero-day vulnerabilities, it’s crucial to stay updated. This blog post aims to answer key questions about some of the most recent vulnerabilities affecting Atlassian Confluence. Atlassian has released an advisory for CVE-2023-22515

—-

Previous Issues of Vulnerability Weekly

—-

What is the CVE-2023-21715 Vulnerability?

CVE-2023-22515 is a critical zero-day vulnerability affecting publicly exposed instances of Confluence Data Center and Server from version 8 on.

A remote, unauthenticated attacker could exploit this privilege escalation to create unauthorized Confluence administrator accounts and access Confluence servers. Exploitation does not require user interaction and is easy to execute.
The confidentiality, integrity and availability of information are impacted to the highest degree.

Atlassian Confluence vulnerabilities refer to security flaws in the Confluence Data Center and Server that can be exploited to gain unauthorized access see vulnerabilities part of your Application Security program, manipulate data, or perform other malicious activities. These vulnerabilities are often critical and require immediate attention.

How Secure is Atlassian Confluence?

Atlassian Confluence is generally considered secure, and reliable for application security, with robust application security measures in place. However, like any software, it is not immune to defects, especially zero-day exploits that are often targeted by nation-state actors.

What is the Latest Vulnerability in Confluence?

This is a critical issue that allows the unauthorized creation of administrator accounts in publicly accessible Confluence instances.

How widespread is this vulnerability CVE-2023-21715?

Shodan currently displays more than 1000 systems across organizations mostly in the USA let’s explore more details on the critical issue

For this critical CVE

  • CVE- 10/9.8
  • CTI – 1.1 (low)
  • EPSS – Very High – 0.935270000
  • Exploit – Confirmed
  • Actors – Nation-state
  • Type: Privilege Escalation
Zero-Day Exploit Nation-State CVE-2023-22515 Vulnerable Versions Security Patch Data Center Server

Currently, there are two streams of attackers on Graynoise divided into a group of 5 and 6 malicious actors but the growing

Graynoise, Atlassian Confluence Critical Vulnerability Zero-Day Exploit Application Security Nation-State CVE-2023-22515 Vulnerable Versions Security Patch Data Center Server
graynoise 2 Confluence Zero-Day Exploit Nation-State CVE-2023-22515 Vulnerable Versions Security Patch Data Center Server Graynoise

Credit Graynoise intelligence

What are the Vulnerable Versions of Confluence for CVE-2023-21715?

CVE-2023-22515 affects Confluence Data Center and Server versions 8.0.0 to 8.5.1. It’s crucial to upgrade to the latest versions to mitigate risks.

Affected Versions CVE-2023-21715

The Confluence Data Center and Server versions listed below are affected by this vulnerability. Customers using these versions should upgrade your instance as soon as possible.

Versions prior to 8.0.0 are not affected by this issue.

ProductAffected Versions
Confluence Data Center and Confluence Server8.0.08.0.18.0.28.0.38.0.48.1.08.1.18.1.38.1.48.2.08.2.18.2.28.2.38.3.08.3.18.3.28.4.08.4.18.4.28.5.08.5.1

Fixed Versions CVE-2023-21715

Atlassian recommends that you upgrade each of your affected installations to one of the listed fixed versions (or any later version) below.

ProductFixed Versions
Confluence Data Center and Confluence Server8.3.3 or later8.4.3 or later8.5.2 (Long Term Support release) or later

Mitigations

One of the mitigations below will prove effective.

  • Restrict external network access to the vulnerable instance
  • Bring the vulnerable instance offline
  • 1. Block access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>

      <web-resource-collection>

        <url-pattern>/setup/*</url-pattern>

                                    <http-method-omission>*</http-method-omission>

                        </web-resource-collection>

      <auth-constraint />

            </security-constraint>

2. Restart Confluence.

How can Phoenix security help with CVE-2023-22515

Nation-State CVE-2023-22515 Vulnerable Versions Phoenix Security

When it comes to identifying which of your systems are exposed to critical vulnerabilities like CVE-2023-22515, Phoenix Security offers a single query and pane of glass for all the risky assets.

Analyse the vulnerability in the phoenix security vulnerability screen and Infrastructure screen to identify which system has been compromised (note since the time of publishing the image the EPSS has changed)

Nation-State CVE-2023-22515 Vulnerable Versions Phoenix Security

Our advanced vulnerability and infrastructure screens are designed to quickly identify systems that are externally facing, making it easier for you to take immediate action. By analyzing the CVE-2023-22515 vulnerability in both the vulnerability and infrastructure screens, Phoenix Security provides a comprehensive view of your risk landscape. This enables you to prioritize patches and other security measures effectively, ensuring that your Atlassian Confluence instances remain secure against zero-day exploits and nation-state threats.

Previous Issues of Vulnerability Weekly

Picture of Francesco Cipollone

Francesco Cipollone

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.
12th October 2023
Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

Join Slack community
Linkedin-in Youtube Facebook-f Twitter Instagram

From our Blog

devsecops, ASPM, vulnerability management, application security, exposure management, reachability analysis, attack surface management, npm supply chain, account takeover, TeamPCP, Mini Shai-Hulud, atool, AntV, jest-canvas-mock, echarts-for-react, Runner.Worker memory scraping, zero-CVE supply chain, CI/CD credential theft, bun runtime, t.m-kosche.com, SBOM
  • 25th May 2026

TrapDoor Supply Chain Campaign: Cross-Ecosystem Credential Theft and AI Assistant Poisoning via npm, PyPI, and Crates.io

TrapDoor is an active supply chain campaign hitting npm, PyPI, and Crates.io simultaneously — 34 malicious packages, 384 artifact versions, confirmed since May 19, 2026. The campaign steals SSH keys, AWS credentials, GitHub tokens, and crypto wallet keystores, while silently poisoning AI coding assistants through hidden zero-width Unicode injected into .cursorrules and CLAUDE.md files. Zero CVEs assigned. Standard scanners return zero findings.
Francesco Cipollone
devsecops, ASPM, vulnerability management, application security, exposure management, reachability analysis, attack surface management, npm supply chain, account takeover, TeamPCP, Mini Shai-Hulud, atool, AntV, jest-canvas-mock, echarts-for-react, Runner.Worker memory scraping, zero-CVE supply chain, CI/CD credential theft, bun runtime, t.m-kosche.com, SBOM
  • 25th May 2026

Laravel Lang Composer supply chain compromise: RCE backdoor force-pushed across 700+ git tags

An attacker with push access to the Laravel-Lang GitHub organization force-rewrote 700+ git tags across 4 Composer packages on May 22, 2026, injecting an RCE backdoor that fires on every PHP application boot. No CVE was assigned — version pinning offered zero protection. The attack stole CI/CD, cloud, and Kubernetes credentials in 3.16 seconds flat.
Francesco Cipollone
devsecops, ASPM, vulnerability management, application security, exposure management, reachability analysis, attack surface management, npm supply chain, account takeover, TeamPCP, Mini Shai-Hulud, atool, AntV, jest-canvas-mock, echarts-for-react, Runner.Worker memory scraping, zero-CVE supply chain, CI/CD credential theft, bun runtime, t.m-kosche.com, SBOM
  • 22nd May 2026

MEGALODON_CI: Automated GitHub Actions Workflow Poisoning and CI/CD Credential Harvesting at Scale

MEGALODON_CI is an active zero-CVE campaign poisoning GitHub Actions workflow files across 3,500+ confirmed public repositories. Automated commits inject a base64-encoded credential harvester that exfiltrates AWS, GCP, and Azure secrets, OIDC tokens, SSH keys, and package registry credentials in a single runner execution. No CVE exists — every traditional scanner is blind to it.
Francesco Cipollone
devsecops, ASPM, vulnerability management, application security, exposure management, reachability analysis, attack surface management, npm supply chain, account takeover, TeamPCP, Mini Shai-Hulud, atool, AntV, jest-canvas-mock, echarts-for-react, Runner.Worker memory scraping, zero-CVE supply chain, CI/CD credential theft, bun runtime, t.m-kosche.com, SBOM
  • 20th May 2026

GitHub Internal Repository Breach via Poisoned VS Code Extension (May 2026): TeamPCP Exfiltrates 3,800 Repos Through the Developer Trust Surface

TeamPCP (UNC6780) breached GitHub’s internal infrastructure on May 19–20, 2026 through a poisoned VS Code extension that ran silently on a developer’s endpoint and exfiltrated approximately 3,800 internal repositories. The attack produced no CVE. Standard CVE-feed scanners, SCA tools, and signed-provenance checks all missed it. This is exactly the zero-CVE developer trust surface gap Phoenix Blue Intelligence and Phoenix Blue Shield are built to close.
Francesco Cipollone
devsecops, ASPM, vulnerability management, application security, exposure management, reachability analysis, attack surface management, npm supply chain, account takeover, TeamPCP, Mini Shai-Hulud, atool, AntV, jest-canvas-mock, echarts-for-react, Runner.Worker memory scraping, zero-CVE supply chain, CI/CD credential theft, bun runtime, t.m-kosche.com, SBOM
  • 20th May 2026

TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated

TeamPCP’s Mini Shai-Hulud worm hit GitHub and PyPI simultaneously on May 19–20, 2026. Three backdoored versions of durabletask — Microsoft’s Azure Python SDK with 417,000 monthly downloads — were published and yanked within hours. A poisoned VS Code extension on a GitHub employee device led to the exfiltration of ~3,800 internal repositories, now listed for sale at $50,000. Zero CVEs exist across the entire nine-week campaign. Traditional scanners have no record of any of it.
Francesco Cipollone

3 critical zero-days. 1 exploit chain. Claude Code. Phoenix Security found what Anthropic missed →

Contents

→ Contents
Derek

Derek Fisher

Linkedin

Head of product security at a global fintech

Derek Fisher – Head of product security at a global fintech. Speaker, instructor, and author in application security.

Derek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk.

Derek got his start in the hardware engineering space where he learned about designing circuits and building assemblies for commercial and military applications. He later pursued a computer science degree in order to advance a career in software development. This is where Derek was introduced to cybersecurity and soon caught the bug. He found a mentor to help him grow in cybersecurity and then pursued a graduate degree in the subject.

Since then Derek has worked in the product security space as an architect and leader. He has led teams to deliver more secure software in organizations from multiple industries. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations.

In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

Jeevan Singh

Jeevan Singh

Linkedin

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James

James Berthoty

Linkedin

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

christophe

Christophe Parisel

Linkedin

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris

Chris Romeo

Linkedin

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

jim

Jim Manico

Linkedin

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

The IKIGAI concept
Protected By
Shield Security PRO