CVE-2022-26137

CVE-2022-26137 is a high-severity vulnerability affecting multiple Atlassian products, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, and Jira Service Management. This flaw allows an unauthenticated remote attacker to bypass Cross-Origin Resource Sharing (CORS) protections by crafting a malicious HTTP request, tricking a user into accessing a malicious URL, and gaining access with the victim's permissions. With a CVSS score of 8.8 (High), the attack requires user interaction but can lead to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.