Atlassian October 2026 bulletin patches 75 unique third-party CVEs across Data Center and Server products, 6 rated critical
Atlassian published its October 2026 security bulletin on Tuesday, listing 162 high-severity and 14 critical-severity vulnerabilities. By SecurityWeek's count these map to 75 unique CVEs, six of them critical. All entries are third-party dependency flaws, and many CVEs appear under several products. Atlassian states that its use of the affected components presents a lower, non-critical assessed risk and does not report any exploitation in attacks.
Entenda a falha
A vulnerabilidade
Atlassian's October 2026 bulletin lists 162 high and 14 critical findings, which SecurityWeek counts as 75 unique CVEs, six of them critical. All are flaws in third-party dependencies in Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. The critical ones are CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525 (Apache Tomcat, Confluence and Crowd), CVE-2026-58062 (Bouncy Castle, Confluence, Crowd, Jira Software, Jira Service Management), CVE-2026-75595 (Netty, Confluence, Jira Software, Jira Service Management) and CVE-2026-77185 (Apache SSHD, Fisheye/Crucible). The portal also lists the critical Tomcat flaw CVE-2026-65905 (Data Center, Crowd), which is absent from the bulletin. The articles give no attacker prerequisites or version numbers; the fixed releases are in the bulletin. Atlassian rates its own risk as lower and non-critical.
Como funciona
The articles do not describe how each flaw works. They only say the bugs sit in open source libraries bundled into Atlassian products. The high-severity ones include denial of service, cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure and code execution. How each is reached depends on how the product uses the library. Atlassian says its use of the affected components presents a lower, non-critical risk.
Por que é vulnerável
The common cause is that Atlassian products ship vulnerable versions of third-party libraries: Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts, Apache ActiveMQ and Apache SSHD. The articles do not give a root cause for any individual CVE. The fix is to update to the latest product versions or the fixed releases listed in the bulletin, which bring in patched dependencies.
Como foi descoberta
These are monthly-bulletin disclosures of third-party dependency flaws; the articles do not say who found them. Atlassian published the bulletin on Tuesday (October 20, 2026) and does not mention any exploitation in attacks. The disclosure portal and the bulletin do not match: the portal lists CVE-2026-65905 but has fewer unique CVEs than the bulletin.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 07:16.
Detalhes técnicos
- Affected products: Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.
- Critical entries: CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525 (Apache Tomcat, Confluence and Crowd); CVE-2026-58062 (Bouncy Castle, Confluence, Crowd, Jira Software and Jira Service Management); CVE-2026-75595 (Netty, Confluence, Jira Software and Jira Service Management); CVE-2026-77185 (Apache SSHD, Fisheye/Crucible).
- Atlassian's disclosure portal also lists CVE-2026-65905, a critical Apache Tomcat flaw affecting Data Center and Crowd, among the issues disclosed on October 20. It is absent from the bulletin, and the portal lists fewer unique CVEs than the bulletin.
- The remaining high-severity flaws affect open source libraries including Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts and Apache ActiveMQ. Many are DoS issues; others are cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure and code execution bugs.
- The article cites CVE-2026-21589, a critical Data Center flaw that attackers began targeting within hours of a PoC being published, as an example of how quickly Atlassian flaws get exploited.
Remediação
Update to the latest product versions or to the fixed releases listed in the bulletin. Keep Atlassian products current, since threat actors often exploit vulnerabilities quickly.
Linha do tempo
-
Atlassian October 2026 bulletin patches 75 unique third-party CVEs across Data Center and Server products, 6 rated critical
ler a análise desta fonte ocultar
Atlassian published its October 2026 security bulletin on Tuesday, listing 162 high-severity and 14 critical-severity vulnerabilities. By SecurityWeek's count these map to 75 unique CVEs, six of them critical. All entries are third-party dependency flaws, and many CVEs appear under several products. Atlassian states that its use of the affected components presents a lower, non-critical assessed risk and does not report any exploitation in attacks.
Technical Details
- Affected products: Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.
- Critical entries: CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525 (Apache Tomcat, Confluence and Crowd); CVE-2026-58062 (Bouncy Castle, Confluence, Crowd, Jira Software and Jira Service Management); CVE-2026-75595 (Netty, Confluence, Jira Software and Jira Service Management); CVE-2026-77185 (Apache SSHD, Fisheye/Crucible).
- Atlassian's disclosure portal also lists CVE-2026-65905, a critical Apache Tomcat flaw affecting Data Center and Crowd, among the issues disclosed on October 20. It is absent from the bulletin, and the portal lists fewer unique CVEs than the bulletin.
- The remaining high-severity flaws affect open source libraries including Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts and Apache ActiveMQ. Many are DoS issues; others are cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure and code execution bugs.
- The article cites CVE-2026-21589, a critical Data Center flaw that attackers began targeting within hours of a PoC being published, as an example of how quickly Atlassian flaws get exploited.
Remediation
Update to the latest product versions or to the fixed releases listed in the bulletin. Keep Atlassian products current, since threat actors often exploit vulnerabilities quickly.