cyber.hendryadrian.com
Security News · securityweek.com

Atlassian October Bulletin Covers 75 Third-Party CVEs Across Its Products

· Original article ↗

Summary

Atlassian’s October 2026 bulletin lists 75 unique third-party CVEs across seven products, including six critical-rated CVEs. Atlassian recommends updating and reports no exploitation in attacks.

Key points

  • The bulletin covers 75 unique CVEs across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.
  • It lists 162 high-severity and 14 critical-severity entries; some CVEs appear under multiple products.
  • The six unique critical-rated CVEs involve Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD.
  • Atlassian says its use of the affected components presents a lower, non-critical assessed risk.
  • The disclosure portal lists CVE-2026-65905 as a critical Apache Tomcat flaw but omits it from the bulletin; the portal also lists fewer unique CVEs.
  • The flaws include denial-of-service, cryptographic, authentication and authorization, SSRF, information disclosure, and code execution issues.
  • Atlassian does not mention exploitation of these vulnerabilities and recommends updating to the latest product versions or listed fixed releases.

Article Details

Event Type
Atlassian security bulletin covering vulnerabilities in Data Center and Server products
Impact
The October 2026 bulletin lists 75 unique CVEs affecting Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. It reports six critical-severity CVEs and numerous high-severity issues, including denial-of-service, cryptographic, authentication and authorization, SSRF, information disclosure, and code execution flaws. Atlassian says the vulnerabilities in its monthly bulletins present a non-critical risk to customers and recommends updating to the latest product versions or fixed releases. The article says Atlassian did not report exploitation of the bulletin vulnerabilities.

CVE

CVE-2026-21589One example is CVE-2026-21589, a critical flaw in Atlassian’s self-hosted Data Center products that attackers began targeting within hours of a PoC being published.CVE-2026-58062CVE-2026-58062 – a Bouncy Castle issue listed for Confluence, Crowd, Jira Software, and Jira Service Management.CVE-2026-65182CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525 – Apache Tomcat issues listed for Confluence and Crowd.CVE-2026-65637CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525 – Apache Tomcat issues listed for Confluence and Crowd.CVE-2026-65905Atlassian’s vulnerability disclosure portal also lists CVE-2026-65905, a critical-severity Apache Tomcat flaw affecting Data Center and Crowd, among the issues disclosed on October 20.CVE-2026-68525CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525 – Apache Tomcat issues listed for Confluence and Crowd.CVE-2026-75595CVE-2026-75595 – a Netty issue listed for Confluence, Jira Software, and Jira Service Management.CVE-2026-77185CVE-2026-77185 – an Apache SSHD issue listed for Fisheye/Crucible.

Vendors

AtlassianAtlassian on Tuesday published its October 2026 security bulletin, which lists 162 high-severity and 14 critical-severity vulnerabilities.

Products

BambooThe affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.BitbucketThe affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.ConfluenceThe affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.CrowdThe affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.Data CenterAtlassian’s vulnerability disclosure portal also lists CVE-2026-65905, a critical-severity Apache Tomcat flaw affecting Data Center and Crowd, among the issues disclosed on October 20.Fisheye/CrucibleThe affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.Jira Service ManagementThe affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.Jira SoftwareThe affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.

Related Articles