Loading story…
Atlassian disclosed a critical OS command injection vulnerability, CVE-2026-21571, in Bamboo Data Center and Server that can let an authenticated attacker execute arbitrary operating system commands and potentially fully compromise vulnerable CI/CD servers. The flaw carries a CVSS 4.0 score of 9.4, requires no user interaction, and affects Bamboo Data Center versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0. Atlassian warned that exploitation could impact confidentiality, integrity, availability, and downstream system security, with added risk to build pipelines, stored credentials, and software supply chains.
Atlassian also reported a separate high-severity denial-of-service issue, CVE-2026-33871, in the bundled io.netty:netty-codec-http2 dependency that could be abused for HTTP/2-based service disruption. The company urged organizations to patch immediately by upgrading to fixed releases, including 9.6.25 or later, 10.2.18 or later, and 12.1.6 or later, with 10.2.18 LTS and 12.1.6 LTS highlighted as recommended targets. Until upgrades are completed, administrators were advised to review deployed Bamboo versions and restrict network access to Bamboo administrative interfaces as a temporary mitigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Atlassian also disclosed CVE-2026-33871, a high-severity denial-of-service vulnerability affecting Bamboo through the bundled io.netty:netty-codec-http2 dependency. The issue carries a CVSS score of 8.7 and could enable HTTP/2-based service disruption on vulnerable Bamboo instances.
Atlassian published a broader April 21, 2026 security bulletin covering multiple vulnerabilities across Bamboo, Bitbucket, Confluence, Jira Software, and Jira Service Management Data Center and Server products. The advisory included fixed release guidance for affected products, including Bitbucket 10.2.2/9.4.19, Confluence 10.2.10/9.2.19, and Jira/JSM 11.3.4/10.3.19, alongside Bamboo updates already separately disclosed.
Atlassian advised customers to upgrade to patched releases, including 9.6.25 or later, 10.2.18 or later, and 12.1.6 or later, and urged immediate patching. It also recommended reviewing deployed versions and applying network-level restrictions to Bamboo administrative interfaces as a temporary mitigation.
Atlassian disclosed CVE-2026-21571, a critical OS command injection vulnerability in Bamboo Data Center that can allow authenticated remote code execution. The flaw affects Bamboo Data Center versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 and was assigned a CVSS 4.0 score of 9.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceconfluence.atlassian.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian published security advisory `AV26-731` covering multiple vulnerabilities, including some rated **critical**, across a broad set of products used in data center, server, and desktop environments. Affected product lines named in follow-on notices include **Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, Jira Service Management, and Sourcetree** for Mac and Windows, and government guidance urged administrators to review the advisories and apply vendor updates. One of the disclosed issues, `CVE-2026-21579`, is a high-severity **information disclosure** flaw in **Atlassian Confluence Data Center** with a CVSS 4.0 score of **8.2**. Atlassian said the vulnerability can be exploited remotely by an **unauthenticated** attacker to access sensitive information, affects multiple Confluence Data Center release lines, and is fixed in supported versions including **9.2.22 or later** and **10.2.14 or later**; customers were advised to upgrade to the latest or patched supported releases.
Jul 24, 2026
Atlassian and Finland’s National Cyber Security Centre warned of multiple severe vulnerabilities in Atlassian products, led by **`CVE-2022-1471`**, a critical SnakeYAML deserialization flaw rated **CVSS 9.8** that can enable remote code execution across **Bitbucket, Confluence, Jira Core, Jira Software, Jira Service Management, Automation for Jira,** and the **Confluence Cloud Migration App**. Atlassian said its hosted **`atlassian.net`** cloud sites are not affected, but Data Center and Server deployments face broad exposure and should be upgraded immediately to fixed releases. The advisories also identified product-specific RCE issues in **Confluence Data Center and Server** (**`CVE-2023-22522`**), the **Assets Discovery** app (**`CVE-2023-22523`**), and **Atlassian Companion App for macOS** (**`CVE-2023-22524`**). Authorities urged organizations to install patched versions without delay and, where patching cannot be completed at once, remove vulnerable services from the public internet; Atlassian added that there is no mitigation for some affected products, while certain Jira and Jira Service Management environments can reduce risk by upgrading the **Automation for Jira** app to a fixed version.
Jun 29, 2026
Atlassian disclosed a critical Confluence vulnerability, **`CVE-2023-22515`**, that can let an attacker create unauthorized administrator accounts and potentially take over the entire environment. Atlassian assessed the flaw as likely falling between **9.0 and 10.0** in severity and urged defenders to restrict access to the vulnerable component until patches could be applied. Authorities warned that any internet-exposed vulnerable instance showing even minor anomalies should be treated as potentially compromised, with indicators including unexpected additions to the `confluence-administrators` group, unexplained user creation, requests to `/setup/*.action`, and evidence of `/setup/setupadministrator.action` in `atlassian-confluence-security.log`. Subsequent analysis indicated the flaw might also be exploitable without creating an administrator account, including through `/server-info.action`, and Microsoft reported signs of exploitation dating back to mid-September 2023. JetBrains later released fixes for critical TeamCity authentication bypass vulnerabilities affecting all on-premises server installations through version **`2023.11.3`**, resolving them in **`2023.11.4`**. The company said an unauthenticated attacker could send specially crafted HTTP(S) requests to bypass authentication or gain administrator-level access, and exploitation attempts had already been observed. JetBrains updated and checked its cloud-hosted service, while defenders running on-premises TeamCity were told to patch immediately and review systems for compromise after updating, underscoring the ongoing risk from exposed enterprise collaboration and CI/CD platforms that can be seized through admin-level access flaws.
Jun 29, 2026