Critical Bamboo Data Centre and Server Flaw Enables Command Injection Attacks

Gbhackers •Divya • April 22, 2026

Atlassian has disclosed a critical OS Command Injection vulnerability (CVE-2026-21571) in Bamboo Data Centre and Server, with a CVSS score of 9.4, enabling authenticated attackers to execute commands on affected systems remotely. The flaw, tracked as CVE-2026-21571, was published as part of Atlassian’s April 21, 2026, Security Bulletin, the company’s monthly disclosure of patched vulnerabilities across […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OS Command Injection Vulnerability in Atlassian Bamboo Disclosed Atlassian has announced two critical vulnerabilities in its Bamboo Data Center and Server product, including a severe OS command injection flaw (CVE-2026-21571) and a high-severity denial-of-service issue. The command injection vulnerability, which has a CVSS score of 9.4, allows authenticated attackers to execute arbitrary commands on affected systems remotely. Organizations using affected versions are urged to apply patches immediately to mitigate the risk. The vulnerabilities were disclosed as part of Atlassian's April 21, 2026, Security Bulletin. The command injection flaw is particularly concerning due to its potential for widespread exploitation. Affected systems include all versions of Bamboo Data Center and Server prior to the patch release. The company emphasizes the urgency of addressing these vulnerabilities to prevent possible attacks. 2 sources 76

Extracted Entities

Critical Bamboo Data Centre and Server Flaw Enables Command Injection Attacks

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)