Bamboo vulnerabilities

8 known vulnerabilities in Bamboo from Atlassian. 8 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Atlassian Multiple Products Files or Directories Accessible to External Parties Exploited

  CVE-2026-21589Oct 5, 2026AtlassianEPSS 99.7%

  This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenti

• 8.1 High severity

  Bamboo Data Center: Improper Authorization

  CVE-2026-21584Aug 18, 2026Atlassian

  This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker t

• 8.8 High severity

  Bamboo Data Center: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-21571Apr 21, 2026AtlassianEPSS 1.34%

  This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Ve

• 8.8 High severity

  Bamboo Data Center: Improper Control of Generation of Code

  CVE-2026-21570Mar 17, 2026Atlassian

  This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an

• 8.0 High severity

  Bamboo Data Center: Improper Control of Generation of Code

  CVE-2024-21689Aug 20, 2024AtlassianEPSS 2.65%

  This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allo

• 8.1 High severity

  Bamboo Data Center: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2024-21687Jul 16, 2024Atlassian

  This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server. This File Inclusion vulnerability, with a CVSS Score of 8.1, allows an authenticated attacker to get

• 8.8 High severity

  Bamboo Server: Origin Validation Error

  CVE-2022-26137Jul 20, 2022AtlassianEPSS 2.41%

  A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue ass

• 9.8 Critical severity

  Bamboo Server: Improper Authentication

  CVE-2022-26136Jul 20, 2022AtlassianEPSS 5.66%

  A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability ca