Bamboo Data Center RCE OS Command Injection (9.6.012.1)
CVE-2026-21571 Published on April 21, 2026
This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands on the remote system, which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center 9.6.0: Upgrade to a release greater than or equal to 9.6.25 Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.18 Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.6 See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-21571 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-21571
Want to know whenever a new CVE is published for Atlassian Bamboo? stack.watch will email you.
Affected Versions
Atlassian Bamboo Data Center:- Version 12.1.0 to 12.1.3 is affected.
- Version 12.0.0 to 12.0.2 is affected.
- Version 11.0.0 to 11.0.8 is affected.
- Version 10.2.0 to 10.2.16 is affected.
- Version 10.1.0 to 10.1.1 is affected.
- Version 10.0.0 to 10.0.3 is affected.
- Version 9.6.2 to 9.6.24 is affected.
- Version 12.1.6 is unaffected.
- Version 10.2.18 is unaffected.
- Version 9.6.25 is unaffected.