No patch yet: Follina and Confluence tested who may switch things off
Two flaws exploited before fixes existed left health systems with workarounds only. The deciding factor was organizational: who could authorize turning something off, who could carry it out across the edges of the estate, and who confirmed it worked.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
Around May 27, 2022, researchers flagged a malicious Word document that abused the Microsoft Support Diagnostic Tool to run code on Windows, a technique nicknamed Follina. On May 30, Microsoft assigned it CVE-2022-30190 and published a workaround that disabled the tool’s URL protocol. A security update followed in the June 14 Patch Tuesday release. On June 2, Atlassian disclosed CVE-2022-26134, a critical unauthenticated remote code execution flaw in Confluence Server and Data Center that was already being exploited. Fixed versions arrived on June 3, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on the day of disclosure. Both flaws were exploited before fixes existed, so for several days the only defenses were configuration changes and cutting access.
Health systems are practiced at the monthly patch cycle. They test, schedule, deploy and report. That rhythm assumes a patch exists. In the days after these two disclosures, it did not. The choice was between a configuration change of uncertain clinical impact on every Windows device, and taking collaboration servers off the internet that some departments relied on daily. Those are not technical decisions. They are decisions about who may disrupt a working system to prevent a possible compromise, at short notice, often outside business hours. The week tested three distinct roles: the person who can authorize the change, the people who can carry it out across every corner of the estate, and the people who confirm it worked and that nothing slipped in first.
Who authorizes
Most hospital change management processes are designed to prevent surprises. A change advisory board meets weekly, clinical stakeholders review anything that touches patient-facing systems, and emergency changes need senior sign-off. That design is sensible for upgrades. It is slow for an exploited zero-day on a Thursday evening.
The organizations that moved fastest had pre-delegated authority. A written rule, approved in advance by the CIO and a senior clinical leader, set out what the CISO could do alone. During active exploitation of a critical flaw, the CISO could restrict internet access to a non-clinical system or push a defensive configuration change. The system owner received notice rather than a request for permission. For systems that touch patient care, the rule named a clinical leader on call who could approve within an hour, and a fallback if that person could not be reached.
Pre-delegation has a cost. Occasionally a defensive change will break something, and someone will be unhappy. The rule should say how that is handled: a quick rollback path, a post-event review that judges the decision on what was known at the time, and no penalty for a reasonable call. Without that protection, people delay.
The same rule should cover the reverse decision. If the CISO decides not to act, because the exposure is internal or the workaround is riskier than the flaw, that choice and its reasoning should be recorded too. Regulators, auditors and insurers reviewing an incident later will ask what was known and when. A short decision log, kept as events unfold, answers that question better than memory.
A practical trigger helps. Many teams used CISA’s Known Exploited Vulnerabilities catalog as one objective signal: a critical flaw on that list, affecting an internet-facing or widely deployed product, activates the emergency authority. A shared trigger cuts the time spent debating whether this event is serious enough.
Who executes at the edges
The Follina workaround was a registry change. On a well-managed central fleet, pushing it was a matter of hours. Health system estates are not one fleet. They include shared clinical workstations, devices running embedded Windows inside clinical equipment, computers owned by affiliated physician practices, research labs with their own administrators, and contractors’ machines on the network. Documents from outside senders, such as referrals, records requests and payer letters, reach all of them.
Confluence exposed a different edge. Research groups, quality departments and informatics teams sometimes ran their own wiki servers, occasionally exposed to the internet and absent from the central configuration database. The guidance was to block internet access or shut them down until patched. That required knowing they existed and having someone with administrative access who would answer the phone.
The execution question is a roster question. For each segment of the estate, the roster should name who has both the technical ability and the authority to make a change within hours. Affiliated practices may need a clause in their network access agreement that obliges them to apply emergency security changes within a set time. Clinical engineering needs a defined role for devices that security staff cannot touch. Research IT needs an on-call contact. External attack surface scanning, which shows internet-facing services the way an attacker sees them, finds the servers no one listed.
Who confirms
A change pushed is not a change applied. Endpoint management consoles report devices that were offline, failed to update, or reverted. Someone has to own the gap report and chase it to zero, segment by segment, and report the residual risk to the person who authorized the change.
Confirmation also has a forensic side. Because both flaws were exploited before disclosure, a server patched under pressure might already have been compromised. Patched is not the same as clean. For the Confluence flaw in particular, the right follow-up was to review server logs for signs of exploitation and look for unfamiliar files or accounts. It also meant rotating credentials stored on the wiki, which often included service account passwords and configuration notes. That work needs an incident responder, not the department administrator who applied the fix.
Clinical confirmation matters too. After a defensive change on clinical workstations, someone should check that key workflows still function: document viewing in the electronic record, printing of wristbands and labels, and integrations with imaging and lab systems. A short checklist, run by clinical informatics on a sample of units, catches breakage before it becomes a safety report.
Each role needs a name, a deputy and a phone number. Health systems that had filled all three treated the week as routine. Those that had filled none discovered that their exposure was set by their org chart rather than their technology.
With hindsight
Both flaws were patched, and the immediate waves of exploitation faded. The pattern repeated at larger scale. Through 2023 and 2024, exploited flaws in internet-facing products, including file transfer tools and VPN gateways, produced the same scramble and caused serious breaches in health care. CISA’s Known Exploited Vulnerabilities catalog became a standard prioritization input well beyond the federal agencies it was built for. Atlassian ended support for its Server products in February 2024, moving many wikis to managed cloud or Data Center editions and reducing the number of forgotten servers. HHS published voluntary cybersecurity performance goals for health care in January 2024 that stressed asset inventory and rapid mitigation of known exploited flaws. By 2026 more health systems have written emergency authority into policy. Fewer have contractual reach into affiliated practices, which remain a common gap.