High7.1Atlassian

CVE-2026-71891: Atlassian Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

This Atlassian advisory covers CVE-2026-71891 in Bamboo Data Center and Server and Fisheye/Crucible.

CVE-2026-71891

Open the Atlassian advisory

Key facts

Vendor rating: High, CVSS 7.1
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber · base score 7.1, scored by bcorgAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: passive. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: high. Availability impact on the vulnerable system: none. Confidentiality impact on subsequent systems: none. Integrity impact on subsequent systems: none. Availability impact on subsequent systems: none.
Weakness: CWE-347 Improper Verification of Cryptographic Signature
CISA SSVC: Exploitation: none observed. Automatable: no. Technical impact: partial. CISA, Oct 5, 2026.
CISA KEV: Not listed (catalogue checked Nov 10, 2026)
Affected: Bamboo Data Center and Server: 12.1.0 to 12.1.11 (LTS); Bamboo Data Center and Server: 12.0.0 to 12.0.2; Bamboo Data Center and Server: 11.0.0 to 11.0.8 and 4 more below
Fixed in: Bamboo Data Center and Server: 12.1.12 (LTS) recommended Data Center Only, Bamboo Data Center and Server: 10.2.24 (LTS) Data Center Only, Fisheye/Crucible: 4.9.15 recommended
Source published: Oct 20, 2026
Listed by VulniPulse: Nov 10, 2026

Compiled by VulniPulse from the linked sources. How records are collected and checked.

Affected products & platforms

AtlassianBamboo / Crowd / Fisheye

Description

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center. Affected: Bamboo Data Center and Server, Fisheye/Crucible.

Listed in Atlassian's Security Bulletin of October 20 2026.

Text from the source record.

Affected versions

Bamboo Data Center and Server: 12.1.0 to 12.1.11 (LTS)
Bamboo Data Center and Server: 12.0.0 to 12.0.2
Bamboo Data Center and Server: 11.0.0 to 11.0.8
Bamboo Data Center and Server: 10.2.0 to 10.2.23 (LTS)
Bamboo Data Center and Server: 10.1.0 to 10.1.1
Bamboo Data Center and Server: 10.0.3
Fisheye/Crucible: 4.9.0 to 4.9.14

Official advisory · high-confidence parse· fetched Nov 10, 2026·verify at source

How to fix CVE-2026-71891

Upgrade to a fixed release named by Atlassian:

Bamboo Data Center and Server: 12.1.12 (LTS) recommended Data Center Only
Bamboo Data Center and Server: 10.2.24 (LTS) Data Center Only
Fisheye/Crucible: 4.9.15 recommended

Vendor guidance

Upgrade to a fixed version listed by Atlassian: Bamboo Data Center and Server: 12.1.12 (LTS) recommended Data Center Only; Bamboo Data Center and Server: 10.2.24 (LTS) Data Center Only; Fisheye/Crucible: 4.9.15 recommended.

Atlassian advisories, October 2026 All Atlassian advisories

Get an email when Atlassian Bamboo / Crowd / Fisheye publishes the next one.

See Atlassian Bamboo / Crowd / Fisheye's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Atlassian Bamboo / Crowd / Fisheye

iPhone and Android apps · New on the App Store

Monitor future Atlassian CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts on Android See app features