Critical

OS Command Injection in Atlassian Bamboo Data Center

IdentifiersCVE-2026-21571CWE-78· Improper Neutralization of Special…

CVE-2026-21571 is a critical OS command injection vulnerability affecting Atlassian Bamboo Data Center. The provided content states the issue was introduced in Bamboo Data Center versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0, and more specifically affects release ranges including 9.6.2 through 9.6.24, 10.0.0 through 10.0.3, 10.1.0 through 10.1.1, 10.2.0 through 10.2.16, 11.0.0 through 11.0.8, 12.0.0 through 12.0.2, and 12.1.0 through 12.1.3. Atlassian classifies it as remote code execution with CVSS 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Based on the advisory text, an authenticated attacker can inject and execute arbitrary operating system commands on the underlying Bamboo server. The vulnerable function or code path is not identified in the provided material.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows execution of arbitrary OS commands on the Bamboo host, resulting in remote code execution. The advisory indicates high impact to confidentiality, integrity, and availability, with no user interaction required. In practical terms, this can enable full server compromise, theft of secrets and credentials stored or accessible through Bamboo, tampering with CI/CD jobs and build artifacts, disruption of pipeline operations, and potential lateral movement into connected internal systems and software supply-chain environments.

Mitigation

If you can’t patch tonight, do this now.

If patching cannot be performed immediately, the provided content indicates that network-level restrictions on Bamboo administrative interfaces can be used as a temporary mitigation. More generally, limit Bamboo access to trusted users and networks, reduce exposure of the application from untrusted networks, and monitor for suspicious command execution or anomalous build activity until fixed versions are deployed. These measures are temporary and do not replace upgrading to a patched release.

Remediation

Patch, then assume compromise.

Atlassian recommends upgrading to the latest Bamboo Data Center release. Where immediate upgrade to latest is not possible, the provided fixed versions are Bamboo Data Center 9.6.25 or later on the 9.6 branch, 10.2.18 or later on the 10.2 branch, and 12.1.6 or later on the 12.1 branch. Organizations should identify deployments within the affected version ranges and prioritize patching exposed or high-value Bamboo instances first.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AtlassianBambooapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

cyber security newsNews

Apr 22, 2026

Critical Atlassian Bamboo Data Center and Server Flaw Enables Command Injection Attacks

A critical OS command injection vulnerability in Atlassian Bamboo Data Center and Server that could allow remote attackers to execute arbitrary operating system commands on the underlying server.

atlassian confluenceNews

Apr 22, 2026

Security Bulletin - April 21 2026 | Atlassian Support | Atlassian Documentation

OS command injection vulnerability affecting Bamboo Data Center.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5