Is CVE-2023-22527 (Atlassian Confluence Data Center and Server Template Injection) being exploited in the wild?

Yes. CISA added CVE-2023-22527 to its Known Exploited Vulnerabilities catalogue on 24 January 2024, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

How to treat CVE-2023-22527 as an active-exploitation event

This is not just a Confluence patching issue, it is a prioritisation event. When CISA places a CVE in the KEV catalogue, the operational assumption should be that exploitation is already credible enough to justify urgent action, not that the risk is hypothetical. For Confluence Data Center and Server, that means exposure review, containment, and remediation planning should move ahead of routine backlog work.

For teams running Atlassian environments, the first question is whether the vulnerable Confluence instance is internet-facing, reachable from trusted partner networks, or otherwise available to an attacker who can send crafted requests. Because the flaw is unauthenticated template injection, the control problem is not just “who can log in,” but whether the application can be made to execute attacker-controlled logic before any authentication barrier is reached.

That is why the most useful reference point for this class of event is the Zero-Day and Exploited Vulnerabilities Guide: the practical response is to treat KEV-listed issues as high-confidence exploitation signals, then shorten the path from detection to mitigation. The same operating model appears across Atlassian incident response, where stale exposure and delayed patching tend to create the real risk window.

What the Confluence weakness means operationally

Template injection in a web application matters because the application is interpreting attacker-supplied input as executable expression logic, not as inert data. In this case, the practical consequence can be remote code execution, which means the outcome is not limited to a malformed page or a broken workflow. If the instance is compromised, the attacker may be able to enumerate the host, access local files, pivot to adjacent systems, or harvest application secrets and tokens stored near the Confluence service.

That is also why Atlassian deployments deserve explicit hardening and inventory discipline. The Atlassian Cloud Security Guide is cloud-focused, but the underlying practitioner lesson transfers well: you need clear ownership of Confluence admin access, plugin exposure, and the places where collaboration platforms hold sensitive data or credentials. The issue is often not the product alone, but the trust boundary around it.

For broader vulnerability handling, the right comparison set is the Vulnerability Management Guide, because exploited-in-the-wild events should be triaged differently from ordinary CVE backlogs. KEV status, exposure, and business criticality matter more than abstract scoring. In practice, that means a reachable Confluence node with active exploitation evidence should outrank many other lower-exposure findings.

What to do if you cannot patch immediately

If patching must wait, the immediate goal is to reduce exploitability and raise the odds of detection. That usually means restricting network reachability to Confluence, limiting administrative access paths, checking for unusual child processes or outbound connections on the host, and validating whether the application or adjacent systems expose secrets that would be worth stealing after code execution.

This is the point where web application attack patterns become useful. The Web Application Attacks Guide helps frame server-side template injection as a class of injection weakness that often leads to code execution, data access, or broader application compromise. If your containment plan only focuses on browser-side behavior, it will miss the server-side execution risk that makes this CVE dangerous.

You should also assume the attacker may use the initial foothold to look for long-lived application secrets, service tokens, and other material that can be reused after the patch. For that reason, delayed remediation should be paired with compromise assessment, not just temporary filtering. If the system was exposed, review logs for anomalous requests, unexpected process launches, file changes, and signs that a web shell or similar post-exploitation tooling was introduced.

Risk and Threat Considerations

This kind of flaw is attractive to attackers because it can turn a public-facing collaboration platform into an execution point with access to internal data and service context. The main risk is not only initial compromise, but what the attacker can reach after landing on the Confluence host, especially if the server stores integration secrets or has broad network visibility.

Failure mechanism: An unauthenticated template-injection path allows attacker-controlled input to be interpreted by the application runtime, which can lead to remote code execution before normal access controls have any chance to intervene.

Impact: A successful exploit can expose content, credentials, session material, or adjacent systems, and it can create a durable foothold for follow-on activity, including ransomware staging or lateral movement.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed CVEs require urgent identification and remediation of exposed systems.
Recommendation — Prioritise and remediate KEV-listed exposures using continuous vulnerability management.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE is about exploited vulnerability discovery, triage, and response.
	SI-2 — Flaw Remediation	Active exploitation makes timely flaw remediation the central control response.
	AU-6 — Audit Record Review, Analysis, and Reporting	Compromise checks depend on reviewing logs for exploitation evidence.
Recommendation — Scan, triage, and track remediation for exposed Confluence instances. Apply fixes or mitigations quickly and verify remediation in production. Review and analyse logs for signs of exploitation and post-exploitation activity.
OWASP ASVS	V15 — Secure Coding and Architecture	Template injection is an application execution flaw with architectural impact.
Recommendation — Eliminate server-side template injection paths through secure design and review.

Practitioner Guidance

What to prioritise: Start with asset confirmation and exposure status, then move to containment and compromise assessment. If the system is internet-facing or reachable from broadly trusted networks, treat it as urgent even if you have not yet observed malicious activity.

What to verify: Confirm whether the Confluence instance handled sensitive attachments, integration secrets, or admin functions, because those define the blast radius if exploitation occurred. Also verify whether logging is sufficient to support retrospective review of suspicious requests and process activity.

Decision rule: If patching is delayed, do not rely on “no alert, no compromise” as a safety signal. Reduce exposure first, then inspect for post-exploitation evidence, and rotate credentials or tokens only where the server could plausibly have exposed them.

Practitioner takeaway: For KEV-listed application flaws, the practical question is not whether exploitation is possible in theory, but whether the vulnerable service can still be reached, abused, and used as a platform for further compromise.