Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) (Updated)
Summary: Volexity found suspicious activity on two internet-facing Confluence servers over Memorial Day weekend 2022, traced to an unauthenticated remote code execution flaw Atlassian assigned CVE-2022-26134, with a patch posted. Cortex Xpanse identified 19,707 potentially affected Confluence Server instances, mostly in the United States, Germany, China and Russia, plus 1,251 end-of-life versions exposed to the internet, and Unit 42 observed exploitation attempts that in one case spawned reconnaissance commands from tomcat.exe and a Base64-encoded PowerShell command that retrieved a Cerber Ransomware binary, which the Cortex XDR agent blocked.
What you should know: A public proof of concept and scanning dating back to May 26, 2022 mean the window between disclosure and exploitation is already closed, and 1,251 end-of-life Confluence servers sitting on the public internet are the ones no patch will reach.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-26134
- Related
- CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 02, 2022