{"id":"CVE-2022-26133","published":"2022-04-20T18:30:19Z","modified":"2024-10-03T14:55:36Z","title":"SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and…","vendor":"Atlassian","product":"Bitbucket Data Center","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Bitbucket Data Center","versions":[">= 5.14.0, < unspecified",">= unspecified, < 7.6.14",">= 7.7.0, < unspecified",">= unspecified, < 7.17.6",">= 7.18.0, < unspecified",">= unspecified, < 7.18.4",">= 7.19.0, < unspecified",">= unspecified, < 7.19.4","7.20.0"]}],"description":{"text":"SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.","provenance":"source","from":"CVE.org"},"summary":{"text":"The SharedSecretClusterAuthenticator component in Atlassian Bitbucket Data Center contains a Java deserialization flaw, affecting versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0. A remote attacker with no authentication and no user interaction can exploit the flaw over the network by sending crafted serialized data to execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:45Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.70591,"percentile":0.99389,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"Confluence Zero-day Flaw has been Actively Exploited","url":"https://otx.alienvault.com/pulse/652e3fe48da809d2d5b9f5c7","created":"2023-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://jira.atlassian.com/browse/BSERV-13173","tags":["x_refsource_MISC"]},{"url":"https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-30700","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-30700","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2022-05-09","earliestUrl":"https://github.com/Pear1y/CVE-2022-26133","repos":[{"name":"Pear1y/CVE-2022-26133","url":"https://github.com/Pear1y/CVE-2022-26133","stars":146,"created":"2022-05-09"},{"name":"abbarhissarh/CVE-2022-26133","url":"https://github.com/abbarhissarh/CVE-2022-26133","stars":3,"created":"2022-06-04"}]},"first":{"date":"2022-05-09","source":"PoC-in-GitHub","url":"https://github.com/Pear1y/CVE-2022-26133"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-04-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-26133","provenance":"source"},{"date":"2022-05-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Pear1y/CVE-2022-26133","provenance":"source"}],"speed":{"daysToPublicExploit":19,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":33.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9939"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}