Loading story…
A critical remote code execution flaw, CVE-2022-36804, affected Atlassian Bitbucket Server and Data Center by allowing user-controlled input to reach underlying Git commands. Researchers showed that a NULL byte injection issue in Java-to-native process execution could let attackers smuggle extra Git options such as --exec, turning repository API requests into arbitrary command execution on Linux systems. Another reported exploitation path used Git functionality to write a JSP file to the server, providing a route to persistent code execution.
Security monitoring later recorded active attacks against exposed Bitbucket instances through multiple API endpoints, following the release of public exploit code. Observed malicious requests targeted repositories with crafted parameters designed to trigger command injection, and defenders were urged to upgrade to Atlassian's fixed versions. Mitigations included Bitbucket-side validation for NULL characters and hardening in the underlying NuProcess library, though the case also highlighted the broader risk of option injection in command-execution features even without NULL bytes.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC reported that it started seeing attacks targeting CVE-2022-36804 against Atlassian Bitbucket Server and Data Center. The observed requests targeted the archive endpoint and used a malicious prefix parameter to inject Git options.
Public exploit code for the Bitbucket Server and Data Center vulnerability CVE-2022-36804 was released, increasing the likelihood of broader exploitation. MBSD-SOC later cited this release as a factor that could drive more attacks.
Atlassian released fixes for CVE-2022-36804 in August 2022 for Bitbucket Server and Data Center. The flaw allowed remote command execution through Bitbucket's handling of Git command arguments.
NuProcess introduced NULL-byte validation in version 2.0.5 following the Bitbucket vulnerability disclosure. The MBSD analysis recommends upgrading to version 2.0.5 or later.
After disclosure of CVE-2022-36804, a Bitbucket engineer submitted a pull request to the NuProcess library to add NULL-byte validation. This was intended to prevent the Java-to-native argument handling issue that enabled the vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian disclosed a critical OS command injection vulnerability, `CVE-2026-21571`, in Bamboo Data Center and Server that can let an authenticated attacker execute arbitrary operating system commands and potentially fully compromise vulnerable CI/CD servers. The flaw carries a CVSS 4.0 score of **9.4**, requires no user interaction, and affects Bamboo Data Center versions `9.6.0`, `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `11.1.0`, `12.0.0`, and `12.1.0`. Atlassian warned that exploitation could impact confidentiality, integrity, availability, and downstream system security, with added risk to build pipelines, stored credentials, and software supply chains. Atlassian also reported a separate high-severity denial-of-service issue, `CVE-2026-33871`, in the bundled `io.netty:netty-codec-http2` dependency that could be abused for HTTP/2-based service disruption. The company urged organizations to patch immediately by upgrading to fixed releases, including `9.6.25` or later, `10.2.18` or later, and `12.1.6` or later, with `10.2.18 LTS` and `12.1.6 LTS` highlighted as recommended targets. Until upgrades are completed, administrators were advised to review deployed Bamboo versions and restrict network access to Bamboo administrative interfaces as a temporary mitigation.
Jun 29, 2026
GitHub disclosed and patched **CVE-2026-3854**, a critical command-injection flaw in its `git push` pipeline that allowed an authenticated user with repository push access to trigger remote code execution using a single crafted push. Wiz reported the bug on March 4, and GitHub said it reproduced the issue within about 40 minutes and deployed a fix to GitHub.com within roughly two hours, later publishing patches for supported GitHub Enterprise Server releases including **3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3**. The vulnerability stemmed from unsanitized user-supplied push option values being inserted into internal `X-Stat` headers, enabling attackers to inject trusted metadata, bypass sandboxing, and execute commands as the `git` service user. Researchers said the flaw could have led to **full server compromise** on GitHub Enterprise Server and, on GitHub.com, code execution on shared storage infrastructure where millions of repositories were accessible to the git service account, creating potential cross-tenant exposure. GitHub said forensic analysis and telemetry found **no evidence of malicious exploitation** and no indication that customer data was accessed, modified, or exfiltrated, but urged Enterprise Server administrators to upgrade immediately and review logs for suspicious push activity. Wiz described the bug as easy to exploit and highlighted its use of AI-assisted reverse engineering tools, including **IDA MCP**, to uncover the issue in GitHub’s closed-source components.
Jul 23, 2026
GitHub awarded researcher Saif Ghani a **$100,000** bug bounty for reporting `CVE-2026-3854`, a critical remote-code-execution vulnerability in its Git push processing pipeline. The flaw reportedly enabled an unauthenticated attacker to supply a specially crafted repository URL during Git-related operations and execute arbitrary commands on GitHub backend infrastructure. GitHub said it deployed mitigations shortly after receiving the report and completed a patch rollout through coordinated disclosure before detailed exploitation information became broadly available. Exploitation could have threatened public and private repository integrity, source-code confidentiality, Git objects, secrets and credentials, build workflows, and the wider software supply chain.
Sep 14, 2026