CVE-2022-43781: Bitbucket Server and Data Center command injection via environment variables

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no privileges or interaction required under public signup, and an EPSS near 0.98 make this a top-priority patch.

What it is

Bitbucket Server and Data Center contains a command injection flaw (CWE-77) reachable through environment variables. An attacker who can control their username can inject commands and execute arbitrary code on the host. If "Allow public signup" is enabled, the issue is exploitable without authentication, making exposure severe for internet-facing instances.

Impact

Successful exploitation gives the attacker arbitrary code execution on the Bitbucket server, with high impact to confidentiality, integrity and availability of the application and its data.

Attack surface

Reached over the network via the application's username handling; no user interaction is required. Authentication is normally needed, but the flaw becomes unauthenticated when public signup is enabled, matching the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.98, 99.9th percentile), indicating strong likelihood of exploitation activity. References are vendor advisory, patch and mitigation pages only, with no public exploit tag.

What to do

• Upgrade Bitbucket Server and Data Center to the fixed version listed in the Atlassian advisory (BSERV-13522) as the first action.
• If immediate patching is not possible, apply the mitigations in the Atlassian advisory and restrict network access to the instance.
• Disable "Allow public signup" so the flaw requires authentication.
• Restrict and audit who can create accounts or control usernames on the instance.
• Place the instance behind access controls or a VPN rather than exposing it directly to the internet.

Detection

• Review Bitbucket server logs for unusual usernames containing shell metacharacters or command-like strings.
• Monitor for unexpected child processes spawned by the Bitbucket service account.
• Alert on new account creation or signup activity, especially where public signup is enabled.
• Hunt for outbound connections or file changes originating from the Bitbucket host that do not match normal application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.