Critical OS Command Injection Vulnerability in Atlassian Bamboo Disclosed

Atlassian disclosed two critical vulnerabilities in Bamboo Server and Data Center in its April 21, 2026 security bulletin; the most severe is CVE-2026-21571, an authenticated OS command injection (CVSS 9.4) allowing remote arbitrary command execution on affected systems. Organizations using vulnerable Bamboo versions are urged to apply the provided patches immediately to mitigate potential widespread exploitation.