“The vulnerability only affects customers of the Confluence Server and Data Center products.”
Atlassian published the OGNL injection fix on August 25. A week later Censys still counted 11,689 vulnerable servers on the open internet. Cyber Command had to tweet a warning before Labor Day weekend. The companies hosting their own wiki to keep it safe are the ones getting owned.