Atlassian Confluence Zero-Day Vulnerability: What Is CVE-2023-25515? | UpGuard

Atlassian Confluence Server and Data Center are subject to CVE-2023-22515, a critical zero-day privilege escalation and broken access control vulnerability actively exploited to create unauthorized administrator accounts. Administrators should immediately upgrade to fixed versions (8.3.3+, 8.4.3+, 8.5.2+), restrict external access to unfixed instances, and investigate IOCs such as unexpected admin-group members, newly created accounts, and requests to /setup/* endpoints.