CVE-2022-36804highunder attackCWE-78CWE-88

CVE-2022-36804: high-severity vulnerability in Atlassian Bitbucket Server

Published · Updated

Follow this CVE+ Monitor Bitbucket Server+ Monitor Bitbucket Data Center

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 99%
from disclosure to weapon13 days
Published on NVDAug 25
1st PoC+13d
metasploitAug 24
CISA KEV+36d
Action required by CISAfederal deadline: 2022-10-21

Apply updates per vendor instructions.

In short

Multiple API endpoints in Atlassian Bitbucket Server and Data Center allow attackers with repository read access to execute arbitrary code through malicious HTTP requests. This enables remote code execution on affected systems, which is critical for maintaining server security.

Technical detail

Remote Code Execution (RCE) vulnerability in Bitbucket API endpoints exploitable via crafted HTTP requests (CWE-78, CWE-88). Attack requires only read permissions to a repository; successful exploitation allows arbitrary code execution on the server. Affects unpatched versions across multiple release branches from 7.0.0 through 8.3.0.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Atlassian · Bitbucket Data CenterAtlassian · Bitbucket Server
public PoCs found — 42
exploitdbwww.exploit-db.com/exploits/51040unverifiedgithubgithub.com/notdls/CVE-2022-36804★ 35githubgithub.com/notxesh/CVE-2022-36804-PoC★ 18githubgithub.com/benjaminhays/CVE-2022-36804-PoC-Exploit★ 16githubgithub.com/SystemVll/CVE-2022-36804★ 12githubgithub.com/sh4den/CVE-2022-36804★ 12githubgithub.com/walnutsecurity/cve-2022-36804★ 8githubgithub.com/kljunowsky/CVE-2022-36804-POC★ 7githubgithub.com/tahtaciburak/cve-2022-36804★ 7githubgithub.com/ColdFusionX/CVE-2022-36804★ 7githubgithub.com/Chocapikk/CVE-2022-36804-ReverseShell★ 4githubgithub.com/Vulnmachines/bitbucket-cve-2022-36804★ 3githubgithub.com/khal4n1/CVE-2022-36804★ 3githubgithub.com/DanielHallbro/CVE-2022-36804-Bitbucket-RCE-Analysis★ 0githubgithub.com/JohanGabrielson/bitbucket-test★ 0githubgithub.com/0xEleven/CVE-2022-36804-ReverseShell★ 0githubgithub.com/Junohea/cve-2022-36804★ 0githubgithub.com/devengpk/CVE-2022-36804★ 0githubgithub.com/JRandomSage/CVE-2022-36804-MASS-RCE★ 0githubgithub.com/imbas007/Atlassian-Bitbucket-CVE-2022-36804★ 0githubgithub.com/asepsaepdin/CVE-2022-36804★ 0vulncheckvulncheck.com/xdb/f437b6e9f563unverifiedcve_referencepacketstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.htmlunverifiedcve_referencepacketstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/c0b121d2bb4funverifiedvulncheckvulncheck.com/xdb/8a763ff2ccf9unverifiedvulncheckvulncheck.com/xdb/0b7d76c7611bunverifiedvulncheckvulncheck.com/xdb/e6120ad8c2faunverifiedvulncheckvulncheck.com/xdb/9acca76e1447unverifiedvulncheckvulncheck.com/xdb/af7d6ba3c236unverifiedvulncheckvulncheck.com/xdb/9828f81b9d39unverifiedvulncheckvulncheck.com/xdb/232d2df2698dunverifiedvulncheckvulncheck.com/xdb/6e85e1c51f7eunverifiedvulncheckvulncheck.com/xdb/0efacd5def82unverifiedvulncheckvulncheck.com/xdb/78e356140b29unverifiedvulncheckvulncheck.com/xdb/8045fbcc75adunverifiedvulncheckvulncheck.com/xdb/a3d1dc5fac30unverifiedvulncheckvulncheck.com/xdb/104d7f8f5541unverifiedvulncheckvulncheck.com/xdb/c9cee1010577unverifiedvulncheckvulncheck.com/xdb/4cf25016ecd3unverifiedvulncheckvulncheck.com/xdb/7b49d3280979unverifiedvulncheckvulncheck.com/xdb/b4359a9ec925unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Bitbucket Server

In the same product, most dangerous first.

CVE-2026-21589CRITICALCVE-2026-21589EPSS 99.7%KEVCVE-2022-43781CRITICALCVE-2022-43781EPSS 98.0%CVE-2022-26133CRITICALCVE-2022-26133EPSS 70.6%CVE-2023-22513HIGHCVE-2023-22513EPSS 15.3%CVE-2019-15000—CVE-2019-15000EPSS 7.8%CVE-2022-26136CRITICALCVE-2022-26136EPSS 5.7%