Initially, the vendor advisory for this unauthenticated RCE (CVE-2022-26134) did not include a patch; the fixed versions were added a day later.
Fixed in Confluence Server and Data Center 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1.
Unfortunately, the vulnerability was being actively exploited in the wild.
Volexity found it while responding to an incident on two internet-facing Confluence servers, where the attackers had loaded an in-memory BEHINDER implant and dropped JSP webshells as backups.
A day later, Steven Adair of Volexity called it a free-for-all across widespread industries, with exploitation that seemed coordinated.
Proof of Concept code is available, and HTTPVoid posted a single request that adds a new Confluence admin user.
The details show that this vulnerability exploits an OGNL injection, which Rapid7 demonstrated with a harmless touch in the URI:
curl -v http://127.0.0.1/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22touch%20/tmp/r7%22%29%7D/