CVE-2026-21571 is an OS Command Injection vulnerability affecting multiple versions of Atlassian Bamboo Data Center (from 9.6.0 to 12.1.3). It permits an authenticated attacker with low privileges to execute arbitrary system commands remotely, resulting in remote code execution. The vulnerability has a CVSS 4.0 base score of 9.4, reflecting its critical severity and high impact on system confidentiality, integrity, and availability. Atlassian has released fixed versions to address this issue and strongly recommends upgrading to these patched releases. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

An authenticated attacker with low privileges can exploit this vulnerability to execute arbitrary OS commands on the Bamboo Data Center server remotely. This can lead to full compromise of the affected system, including unauthorized access to sensitive data, modification or deletion of data, and disruption of service availability. The high CVSS score and vector indicate that exploitation requires no user interaction and has a broad impact on security properties.

Atlassian recommends upgrading affected Bamboo Data Center instances to fixed versions: 9.6.25 or later for the 9.6.x line, 10.2.18 or later for the 10.2.x line, and 12.1.6 or later for the 12.1.x line. Users unable to upgrade immediately should prioritize planning an upgrade as no temporary or partial mitigations are specified. Patch status is confirmed by the vendor advisory and release notes. No cloud service is involved, so remediation is the responsibility of the Bamboo Data Center administrators.