BitBucket Server At Risk From Command Injection

This report details CVE-2022-36804, a command-injection RCE in Bitbucket Server/Data Center, noting over 1,500 exposed Bitbucket instances (including critical infrastructure organizations), the rapid public distribution and selling of PoCs, and the high likelihood of active exploitation with the potential for code theft and remote shells; it recommends applying vendor patches or mitigation and reducing internet exposure.