PT-2026-34015 · Atlassian · Bamboo

Published 2026-04-21 · Updated 2026-04-27 · CVE-2026-21571

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Bamboo Data Center versions 9.6.0 through 9.6.24 Bamboo Data Center versions 10.0.0 through 10.2.17 Bamboo Data Center versions 11.0.0 through 12.1.5

Description An OS Command Injection issue allows an authenticated attacker to achieve Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a target machine. This flaw requires no user interaction and has a high impact on confidentiality, integrity, and availability.

Recommendations Upgrade versions 9.6.0 through 9.6.24 to a release greater than or equal to 9.6.25. Upgrade versions 10.0.0 through 10.2.17 to a release greater than or equal to 10.2.18. Upgrade versions 11.0.0 through 12.1.5 to a release greater than or equal to 12.1.6.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-21571

Affected Products

Bamboo

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-21571 · Security Note
• https://twitter.com/0dayPublishing/status/2046641491251015922 · Twitter Post
• https://twitter.com/threatcluster/status/2046932773223460913 · Twitter Post
• https://jira.atlassian.com/browse/BAM-26364 · Note
• https://twitter.com/Netlas_io/status/2046884466774225309 · Twitter Post
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1770913890 · Note
• https://twitter.com/UndercodeUpdate/status/2047057446699467141 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2046784624244789692 · Twitter Post
• https://twitter.com/CVEnew/status/2048910159142081000 · Twitter Post