--- title: "Examining the Follina and Confluence Vulnerabilities: Risks, Remediation, and Vulnerability Management" description: No single piece of software is perfect, and vulnerabilities are common; but when you consider that the average cost of a data breach was over $4 million in 2021, it is of paramount importance to consider how your business prepares for and reacts to vulnerabilities with a robust software risk management plan. image: https://csacyber.com/hubfs/confluence.png --- [Skip to content](https://csacyber.com/blog/examining-the-follina-and-confluence-vulnerabilities-risks-remediation-and-vulnerability-management#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search August 16, 2022 3 min read time # Examining the Follina and Confluence Vulnerabilities: Risks, Remediation, and Vulnerability Management ![Cyber Security Associates](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Cyber Security Associates -](https://csacyber.com/blog/author/cyber-security-associates) [Consultancy](https://csacyber.com/blog/tag/consultancy) ![](https://csacyber.com/hubfs/confluence.png) No single piece of software is perfect, and vulnerabilities are common; but when you consider that the average cost of a data breach was over $4 million in 2021, it is of paramount importance to consider how your business prepares for and reacts to vulnerabilities with a robust software risk management plan. Two high-profile vulnerabilities that recently made headlines were Follina, a Microsoft Office zero-day, and a bug in Atlassian’s Confluence Server and Data Center. Patches have been released for both, and it’s critical that organizations update their systems; otherwise, cybercriminals will continue to exploit the flaws. Have you updated yours? Let’s take a closer look at what Follina and Confluence are and how best to stay on top of vulnerability management. ### Follina Vulnerability Follina is a critical zero-day vulnerability that impacted all major versions of Windows, including Windows 11, Windows 10, Windows 8.1 and Windows 7. Follina allows hackers to run malware remotely on Windows without being identified by Windows Defender or any other security software. ##### The exploit got the name Follina because the sample file references 0438, which is the area code of Follina, Italy. The attack was explicitly linked to the Microsoft Support Diagnostic Tool (MSDT), with hackers running PowerShell commands through MSDT when opening malicious Office documents. It targeted Word’s remote template feature to retrieve an HTML file from a remote web server and then used the MSDT protocol to load code and execute the PowerShell commands. ### Confluence Vulnerability Atlassian recently disclosed a critical vulnerability affecting its Confluence Server and Data Center that enabled an unauthenticated attacker to execute arbitrary code on an affected instance. The vulnerability existed in an app, Questions for Confluence, which, when enabled on a Confluence Server or Data Center, created a user account with a hardcoded password that would migrate data from the app to the cloud. The password was published on social media, allowing attackers to log in remotely and exploit sensitive data. ##### If you’re self-hosting Atlassian Confluence, you must get the patch deployed as quickly as possible. ### Take a collective approach to vulnerability management Follina and Confluence have highlighted a lack of visibility within organizations regarding cybersecurity policies and processes, which is a common issue. Take vulnerability management, for example. The fewer people involved in this process, the greater the risk, as it leaves you with limited knowledge of any potential threats. ##### Agreeing on a collective approach to vulnerability management is critical to business-as-usual activities. This is especially true when you consider that many issues arise as a result of employees independently adopting certain types of software in an attempt to make their job easier, without much thought for security. It’s important to take a risk-based approach to vulnerability management and use simple techniques, such as scanning the right assets regularly to identify potential threats or gaps in your security. This includes applications that aren’t routinely used but still form part of your operations. Establishing a clear vulnerability management plan, or software risk management plan, that onboards all team members can help identify threats that are not straightforward to fix. This will help ensure that these threats are addressed as early as possible. The top three key things to consider are: **Assess all systems** – When it comes to conducting threat assessments, don’t just look at systems that are in everyday use. Consider all platforms deemed critical to your business, even those that aren’t used regularly. **Vulnerability scanning** – Utilize scanning to observe and manage the entire vulnerability lifecycle. This will not only identify potential threats within your network but also reduce the risk of exposure. **Think outside the box** – It’s important to remember that the threat landscape is constantly evolving. As a result, you must protect yourself and your organization against techniques that are outside the norm, such as SMiShing, which is on the rise. ### What is SMiShing? In recent years, there has been a sharp rise in the number of SMiShing, or SMS phishing, attacks. What looks like an innocent text message from a reputable company can, in fact, be far more sinister. In 2020 alone, the FBI estimated that this new form of cyberattack cost US citizens over $50 million. Hackers send SMS messages that appear to be a demand for late payment, encouraging people to click a link and submit secure information to avoid further action. What has actually happened is that an individual has unwittingly downloaded malware or shared sensitive details with cybercriminals, which can then be used to exploit the organization. Unfortunately, it’s becoming increasingly difficult to distinguish a real SMS from a SMiShing message. As technology becomes more sophisticated, so do hackers’ techniques; yet, the average human remains easy to fool. Just because a message says it’s from Amazon, how do we know it actually is? For this reason, many businesses are turning to applications such as ‘Android for Business’, which ensures all sensitive data is sandboxed from external users. At CSA, we provide sophisticated social engineering tests to illuminate where vulnerabilities like SMiShing might exist. Take a look at our Social Engineering & Phishing Simulation Services for more information. Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images%20%281%29.jpg?width=624&height=427&name=Blog%20images%20%281%29.jpg)](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) October 19, 2026 5 min read ### [When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) The recent cyber incidents involving two Texas-bound energy tankers may be one of the clearest... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images.jpg?width=624&height=427&name=Blog%20images.jpg)](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) October 16, 2026 14 min read ### [The attack surface has changed. The fundamentals have not.](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) Note from the author: Fair warning: this turned into a longer post than planned. I’m under no... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Cyber Security Associates", "url" : "https://csacyber.com/blog/author/cyber-security-associates" }, "dateModified" : "2024-12-07T13:54:58.532Z", "datePublished" : "2022-08-16T04:15:00.000Z", "headline" : "Examining the Follina and Confluence Vulnerabilities: Risks, Remediation, and Vulnerability Management", "image" : [ "https://csacyber.com/hubfs/confluence.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/examining-the-follina-and-confluence-vulnerabilities-risks-remediation-and-vulnerability-management", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```