The Confluence CVE-2023-22515 vulnerability: Overview, detection, and remediation

Executive summary: CVE-2023-22515 is a trivial-to-exploit Confluence Server/Data Center broken access control vulnerability that permits unauthenticated actors to create administrative accounts; the report documents active exploitation observed in the wild (CISA listing, Microsoft telemetry, honeypots), provides detection queries and IoCs (multiple source IPs, user agents, and HTTP request patterns), and recommends immediate patching to non-vulnerable Confluence versions.