CVE-2022-26133: Atlassian Bitbucket Data Center

Critical severity, CVSS 9.8. EPSS: 70.4% chance of exploitation in the next 30 days.

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.

Affected products

• Atlassian Bitbucket Data Center: from 5.14.0, before 7.6.14 (fixed in 7.6.14); from 7.7.0, before 7.17.6 (fixed in 7.17.6); from 7.18.0, before 7.18.4 (fixed in 7.18.4); from 7.19.0, before 7.19.4 (fixed in 7.19.4); version 7.20.0 only

Published 2022-04-20. Last modified 2026-06-17.