“In the recently updated advisory, it conceded an attacker could reset Confluence and create an administrator account.”
Atlassian first rated CVE-2023-22518 at 9.1 and warned of “significant data loss.” Then attackers started handing out admin accounts and Cerber ransomware, and the score went to 10. The first Cerber sample hit VirusTotal less than 24 hours after the original advisory. Over 200,000 Confluence results show up on Shodan. Atlassian rated the bug after the ransomware crews had already graded it.