VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 13:41 UTC

CVE-2022-36804

Read full description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

CVSS 8.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.8/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.8: +1.32
Fresh EPSS: 99.08%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 6 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

flyingpenguin.com

Press · 14 Jun 2026, 07:00 · Amazon Told the White House to Kill Anthropic Fable Model Running on AWS - flyingpenguin.com

Rapid7

Press · 12 Jan 2023, 08:00 · Recog Release v3.0.3 (2022.10.20) - Rapid7

SOC Prime

Press · 23 Sep 2022, 07:00 · What Is Initial Access? MITRE ATT&CK® Initial Access Tactic | TA0001 - SOC Prime

Rapid7

Press · 20 Sep 2022, 07:00 · CVE-2022-36804: Easily Exploitable Vulnerability in Atlassian Bitbucket Server and Data Center - Rapid7

The Hacker News

Press · 26 Aug 2022, 07:00 · Critical Vulnerability Discovered in Atlassian Bitbucket Server and Data Center - The Hacker News

See all 6 source documents

BleepingComputer

Press · 26 Aug 2022, 07:00 · Atlassian Bitbucket Server vulnerable to critical RCE vulnerability - BleepingComputer

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.8 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 7 repos with metrics

Repository	Stars	Forks	Language	Updated
notxesh/CVE-2022-36804-PoC	18	8	Python	19 Sep 2022, 13:49
benjaminhays/CVE-2022-36804-PoC-Exploit	16	10	Python	23 Nov 2023, 03:45
sh4den/CVE-2022-36804	12	4	Python	06 Jul 2026, 08:38
kljunowsky/CVE-2022-36804-POC	7	3	Python	21 Jan 2023, 02:14
tahtaciburak/cve-2022-36804	7	2	Python	25 Sep 2022, 13:18
Chocapikk/CVE-2022-36804-ReverseShell	4	1	Python	24 Sep 2022, 15:19
0xEleven/CVE-2022-36804-ReverseShell	0	2	—	24 Sep 2022, 15:19

Public exploit evidence

exploitdb #51040 2023-03-23

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.8; EPSS 99.1%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, low privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:41.345711+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

25 Aug 2022, 05:40

First press mention

26 Aug 2022, 07:00

Added to the CISA KEV catalog

30 Sep 2022, 00:00

Latest press mention

14 Jun 2026, 07:00

Score calculated

05 Nov 2026, 13:58

PoCs on GitHub

7 repositories