Loading story…
Atlassian disclosed two high-severity cryptographic failures in Bamboo Data Center tied to vulnerable Bouncy Castle for Java components, affecting versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0. The advisories say an unauthenticated attacker could exploit the flaws without user interaction, potentially exposing assets in the environment and causing high confidentiality impact. Atlassian assigned both issues a CVSS 4.0 score of 8.7 and said the defects do not directly affect integrity or availability.
One issue involves org.bouncycastle:bcpkix-jdk18on, where CMS AuthenticatedData content is not properly bound to the MAC when authAttrs are present in Bouncy Castle versions before 1.85; the other affects org.bouncycastle:bcprov-jdk18on, where KCCMBlockCipher fails to bind the nonce when AAD is absent, enabling cross-nonce AEAD forgery. Atlassian directed customers to upgrade to the latest Bamboo Data Center release or, at minimum, move to fixed supported versions 10.2.22 or 12.1.10 and later; Atlassian’s release documentation identifies Bamboo 12.1 as the current long-term support line with 12.1.7 previously listed as the latest bug-fix release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Atlassian disclosed a second high-severity cryptographic failure in Bamboo Data Center tied to the org.bouncycastle:bcprov-jdk18on dependency, affecting the same Bamboo versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0. The advisory says the flaw can be exploited by an unauthenticated attacker without user interaction and recommends upgrading to the latest release or to 10.2.22+ and 12.1.10+.
Atlassian disclosed a high-severity cryptographic failure in Bamboo Data Center tied to the org.bouncycastle:bcpkix-jdk18on dependency, affecting versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0. Atlassian rated the issue CVSS 4.0 8.7 and advised customers to upgrade, or at minimum move to fixed supported versions 10.2.22+ or 12.1.10+.
Atlassian's Bamboo release notes page documents product releases, bug-fix versions, long-term support tracks, and links to historical Bamboo security advisories, including advisories dating from 2008 through 2021. The page also identifies Bamboo 12.1 as the latest release and 12.1.7 as the latest bug-fix release on the page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
jira.atlassian.com
Open sourcejira.atlassian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Atlassian disclosed two high-severity cryptographic failures in **Bamboo Data Center** tied to the `org.bouncycastle:bcpkix-jdk18on` dependency, affecting versions `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `12.0.0`, and `12.1.0`. Both issues carry a **CVSS 4.0 score of 8.7** and can be exploited remotely without authentication or user interaction. One flaw stems from Bouncy Castle `CMS verifySignatures` incorrectly returning true for `SignedData` objects with zero signers before version `1.85`, creating a high-integrity risk by allowing an attacker to alter the actions taken by a system call. A second underlying Bouncy Castle flaw affects `CMS AuthEnvelopedData` decryption before version `1.85` by failing to enforce tag length, creating a high-confidentiality risk that could expose assets in the environment. Atlassian advised customers to upgrade to the latest Bamboo Data Center release or to supported fixed versions **`10.2.22` or later** and **`12.1.10` or later**. The vendor also noted related affected Bouncy Castle LTS and FIPS branches in its advisories.
Aug 19, 2026
Atlassian disclosed a critical OS command injection vulnerability, `CVE-2026-21571`, in Bamboo Data Center and Server that can let an authenticated attacker execute arbitrary operating system commands and potentially fully compromise vulnerable CI/CD servers. The flaw carries a CVSS 4.0 score of **9.4**, requires no user interaction, and affects Bamboo Data Center versions `9.6.0`, `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `11.1.0`, `12.0.0`, and `12.1.0`. Atlassian warned that exploitation could impact confidentiality, integrity, availability, and downstream system security, with added risk to build pipelines, stored credentials, and software supply chains. Atlassian also reported a separate high-severity denial-of-service issue, `CVE-2026-33871`, in the bundled `io.netty:netty-codec-http2` dependency that could be abused for HTTP/2-based service disruption. The company urged organizations to patch immediately by upgrading to fixed releases, including `9.6.25` or later, `10.2.18` or later, and `12.1.6` or later, with `10.2.18 LTS` and `12.1.6 LTS` highlighted as recommended targets. Until upgrades are completed, administrators were advised to review deployed Bamboo versions and restrict network access to Bamboo administrative interfaces as a temporary mitigation.
Jun 29, 2026
Atlassian products including **Bamboo**, **Bitbucket**, **Confluence**, **Crowd**, **Jira**, **Jira Service Management**, and **Fisheye/Crucible** were flagged by the Canadian Centre for Cyber Security as affected by multiple vulnerabilities, with administrators urged to review Atlassian’s bulletin and apply updates as fixes become available. The affected Crucible range was identified as `4.9.0` through `4.9.12`, while Atlassian release documentation shows current supported branches for products such as Crucible `4.9` and Bitbucket Data Center `10.x`, underscoring that supported enterprise deployments are in scope. Atlassian’s product advisories describe a wide mix of high-severity flaws in bundled dependencies, including unauthenticated **remote code execution**, **denial of service**, **information disclosure**, **injection**, **SQL injection**, **request smuggling**, **broken authentication**, **insecure deserialization**, and **man-in-the-middle** weaknesses. Published fixes include Bamboo Data Center `10.2.22+` and `12.1.10+`, Bitbucket Data Center `9.4.23+`, `10.2.6+`, and `10.4.2+`, Confluence Data Center `9.2.23+` and `10.2.15+`, Crowd Data Center `7.2.2+`, and Crucible Server `4.9.13+`, with several issues tied to upstream components such as **Netty**, **Spring**, **Bouncy Castle**, **Jackson**, **Axios**, **PostgreSQL JDBC**, **Jetty**, and **Tomcat**.
Aug 20, 2026