Atlassian has issued a critical security warning to users of its Confluence collaboration tool after being alerted of an ongoing cyberattack that is exploiting a flaw in the software.

Issued yesterday (2 June), the advisory states that the attack has affected “all supported versions” of Confluence Server and Data Center, two Atlassian products aimed at software development teams and enterprises to collaborate with each other.

Confluence is an online platform where people can work from a series of documents shared in the cloud. It is one of Atlassian’s many products, which include popular collaboration tools Trello and Jira.

“Atlassian has been made aware of current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server,” the company wrote on its website.

This means that an unauthenticated remote attacker could exploit this vulnerability to execute code remotely, causing potential harm to enterprise systems.

“Further details about the vulnerability are being withheld until a fix is available. We are actively working on a patch for impacted versions and will update the advisory with estimates for completion.”

Atlassian, which primarily develops products for software developers, project managers and other small teams, rated the cyberattack as “critical” – its highest security threat level rating.

While there are currently no fixed versions of Confluence Server and Data Center available, Atlassian urged customers urged to work with security teams to “consider the best course of action”, including restricting software’s access to the internet and disabling them.

Both these options can potentially cause significant disruption for remote workers using the tool, exacerbated by the fact that Atlassian hasn’t yet issued a timeline for an expected patch to the flaw.

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued its own advisory to users of the software.

“CISA urges organisations with affected Atlassian’s Confluence Server and Data Center products to block all internet traffic to and from those devices until an update is available and successfully applied.”

10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.

The post Atlassian issues security alert to users of its Confluence software appeared first on Silicon Republic.