CVE-2022-36804VulnerabilityPublished 09/30/2022Updated 10/24/2026
CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Affects Atlassian Bitbucket Server and Data CenterSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 09/30/2022
- KEV deadline
- 10/21/2022
- EPSS
- 99.2% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.