CVE-2026-21571

Deeper analysis

CVE-2026-21571 is a critical OS command injection vulnerability, tracked under CWE-78, that affects Bamboo Data Center versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0. The flaw permits remote code execution with a CVSS 4.0 score of 9.4 and the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, giving an authenticated attacker the ability to run arbitrary commands on the underlying system.

An authenticated attacker with network access can exploit the issue without user interaction to achieve full remote code execution, resulting in high impact to the confidentiality, integrity, and availability of the affected Bamboo instance and any connected systems.

Atlassian has published mitigation guidance directing customers to upgrade Bamboo Data Center to fixed releases, specifically 9.6.25 or later for the 9.6 branch, 10.2.18 or later for the 10.2 branch, and 12.1.6 or later for the 12.1 branch; the vendor also provides release notes and download archives for these updates. The associated EPSS score remains low, moving only from 0.0109 to a peak of 0.0117.