Loading story…
Atlassian disclosed two high-severity cryptographic failures in Bamboo Data Center tied to the org.bouncycastle:bcpkix-jdk18on dependency, affecting versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0. Both issues carry a CVSS 4.0 score of 8.7 and can be exploited remotely without authentication or user interaction. One flaw stems from Bouncy Castle CMS verifySignatures incorrectly returning true for SignedData objects with zero signers before version 1.85, creating a high-integrity risk by allowing an attacker to alter the actions taken by a system call.
A second underlying Bouncy Castle flaw affects CMS AuthEnvelopedData decryption before version 1.85 by failing to enforce tag length, creating a high-confidentiality risk that could expose assets in the environment. Atlassian advised customers to upgrade to the latest Bamboo Data Center release or to supported fixed versions 10.2.22 or later and 12.1.10 or later. The vendor also noted related affected Bouncy Castle LTS and FIPS branches in its advisories.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In the same 2026-08-07 notices, Atlassian advised customers to upgrade to the latest Bamboo Data Center release or to supported fixed versions. The notices identified Bamboo Data Center 10.2.22+ and 12.1.10+ as fixed releases for supported branches.
On 2026-08-07, Atlassian disclosed high-severity cryptographic failure vulnerabilities affecting Bamboo Data Center versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 due to underlying Bouncy Castle for Java issues. Atlassian rated the issues CVSS 4.0 8.7 and said they could be exploited remotely without authentication or user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
jira.atlassian.com
Open sourcejira.atlassian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian disclosed two high-severity cryptographic failures in **Bamboo Data Center** tied to vulnerable **Bouncy Castle for Java** components, affecting versions `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `12.0.0`, and `12.1.0`. The advisories say an **unauthenticated attacker** could exploit the flaws without user interaction, potentially exposing assets in the environment and causing **high confidentiality impact**. Atlassian assigned both issues a **CVSS 4.0 score of 8.7** and said the defects do not directly affect integrity or availability. One issue involves `org.bouncycastle:bcpkix-jdk18on`, where **CMS AuthenticatedData** content is not properly bound to the MAC when `authAttrs` are present in Bouncy Castle versions before `1.85`; the other affects `org.bouncycastle:bcprov-jdk18on`, where **KCCMBlockCipher** fails to bind the nonce when AAD is absent, enabling cross-nonce AEAD forgery. Atlassian directed customers to upgrade to the latest Bamboo Data Center release or, at minimum, move to fixed supported versions **`10.2.22`** or **`12.1.10`** and later; Atlassian’s release documentation identifies Bamboo `12.1` as the current long-term support line with `12.1.7` previously listed as the latest bug-fix release.
Aug 19, 2026
Atlassian disclosed a critical OS command injection vulnerability, `CVE-2026-21571`, in Bamboo Data Center and Server that can let an authenticated attacker execute arbitrary operating system commands and potentially fully compromise vulnerable CI/CD servers. The flaw carries a CVSS 4.0 score of **9.4**, requires no user interaction, and affects Bamboo Data Center versions `9.6.0`, `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `11.1.0`, `12.0.0`, and `12.1.0`. Atlassian warned that exploitation could impact confidentiality, integrity, availability, and downstream system security, with added risk to build pipelines, stored credentials, and software supply chains. Atlassian also reported a separate high-severity denial-of-service issue, `CVE-2026-33871`, in the bundled `io.netty:netty-codec-http2` dependency that could be abused for HTTP/2-based service disruption. The company urged organizations to patch immediately by upgrading to fixed releases, including `9.6.25` or later, `10.2.18` or later, and `12.1.6` or later, with `10.2.18 LTS` and `12.1.6 LTS` highlighted as recommended targets. Until upgrades are completed, administrators were advised to review deployed Bamboo versions and restrict network access to Bamboo administrative interfaces as a temporary mitigation.
Jun 29, 2026
Atlassian products including **Bamboo**, **Bitbucket**, **Confluence**, **Crowd**, **Jira**, **Jira Service Management**, and **Fisheye/Crucible** were flagged by the Canadian Centre for Cyber Security as affected by multiple vulnerabilities, with administrators urged to review Atlassian’s bulletin and apply updates as fixes become available. The affected Crucible range was identified as `4.9.0` through `4.9.12`, while Atlassian release documentation shows current supported branches for products such as Crucible `4.9` and Bitbucket Data Center `10.x`, underscoring that supported enterprise deployments are in scope. Atlassian’s product advisories describe a wide mix of high-severity flaws in bundled dependencies, including unauthenticated **remote code execution**, **denial of service**, **information disclosure**, **injection**, **SQL injection**, **request smuggling**, **broken authentication**, **insecure deserialization**, and **man-in-the-middle** weaknesses. Published fixes include Bamboo Data Center `10.2.22+` and `12.1.10+`, Bitbucket Data Center `9.4.23+`, `10.2.6+`, and `10.4.2+`, Confluence Data Center `9.2.23+` and `10.2.15+`, Crowd Data Center `7.2.2+`, and Crucible Server `4.9.13+`, with several issues tied to upstream components such as **Netty**, **Spring**, **Bouncy Castle**, **Jackson**, **Axios**, **PostgreSQL JDBC**, **Jetty**, and **Tomcat**.
Aug 20, 2026