CVE-2022-36804: Atlassian Bitbucket Server and Data Center API command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw allows authenticated remote code execution, is listed in CISA KEV, has public exploits, and has an EPSS score above 99%, making it an urgent patching priority.

What it is

Multiple API endpoints in Atlassian Bitbucket Server and Data Center fail to properly neutralize command and argument input, allowing OS command injection. An attacker with read access to any public or private repository can execute arbitrary code on the server via a crafted HTTP request.

Impact

An attacker gains remote code execution with the privileges of the Bitbucket service account, compromising the host and any repositories or credentials it can reach. This can lead to full server takeover and data theft.

Attack surface

Reached over the network through Bitbucket API endpoints; the attacker needs only read permissions to a public or private repository and no user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network reachability with low privileges and no UI.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-09-30, and public exploit code is referenced in Packet Storm advisories. EPSS is 0.99174 (99.9th percentile), indicating very high likelihood of exploitation.

What to do

• Upgrade Bitbucket Server and Data Center to a fixed version: 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, or 8.3.1 and later.
• If immediate patching is not possible, restrict network access to Bitbucket API endpoints to trusted users and networks.
• Review and reduce repository read permissions so that only necessary accounts can access public or private repositories.
• Monitor for and apply vendor mitigations or workarounds referenced in Atlassian advisory BSERV-13438.
• After patching, rotate credentials and secrets that may have been exposed on the Bitbucket host.

Detection

• Inspect Bitbucket HTTP access logs for unusual or malformed requests to API endpoints, especially those containing shell metacharacters or command-like parameters.
• Monitor for unexpected child processes spawned by the Bitbucket service account (e.g., shell, curl, wget, or system utilities).
• Alert on outbound network connections from the Bitbucket server to unknown external hosts.
• Use file integrity monitoring on Bitbucket installation and repository directories for unauthorized changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.