CVE-2026-21570
Severity CVSS v4.0:
HIGH
Type:
CWE-94
Code Injection
Publication date:
17/03/2026
Last modified:
18/03/2026
Description
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.<br />
<br />
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system.<br />
<br />
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:<br />
Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24<br />
<br />
Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16<br />
<br />
Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.3<br />
<br />
See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).<br />
<br />
This vulnerability was reported via our Atlassian (Internal) program.
Impact
Base Score 4.0
8.60
Severity 4.0
HIGH