Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian's October 2026 security bulletin addresses 75 unique CVEs in third-party components utilized across its Data Center and Server product lineups.
Radwan AbdulhadiEditor and technology writer
Overview of the October 2026 Security Bulletin
On Tuesday, Atlassian published its October 2026 security bulletin, detailing a comprehensive list of vulnerabilities affecting its software. According to reporting by SecurityWeek, the bulletin outlines 176 total vulnerability entries, all of which are tied directly to third-party dependencies rather than core proprietary code. Many Common Vulnerabilities and Exposures (CVEs) appear across multiple products within the company's ecosystem.
When consolidating overlapping identifiers, the advisory covers 75 unique CVEs. Among these are 14 critical-severity issues and 162 high-severity vulnerabilities. The affected self-hosted solutions include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.
Critical-Severity Vulnerabilities and Components
Out of the total unique flaws, six are rated with a critical severity score. These include Apache Tomcat issues such as CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525, which are listed specifically for Confluence and Crowd. Furthermore, a Bouncy Castle issue tracked as CVE-2026-58062 impacts Confluence, Crowd, Jira Software, and Jira Service Management.
Additional critical flaws involve a Netty component issue designated as CVE-2026-75595—affecting Confluence, Jira Software, and Jira Service Management—and an Apache SSHD issue identified as CVE-2026-77185, which is listed for Fisheye/Crucible. For each of these major flaws, Atlassian explicitly notes that its specific integration and use of the affected component presents a lower, non-critical assessed risk.
A discrepancy also appeared regarding the company's online documentation. Atlassian's vulnerability disclosure portal lists CVE-2026-65905, a critical-severity Apache Tomcat flaw affecting Data Center and Crowd, among the issues disclosed on October 20. However, this particular CVE does not appear directly within the main published bulletin, and the portal lists fewer unique CVEs overall than the formal advisory.
High-Severity Open Source Library Flaws
Beyond the critical entries, the remaining high-severity flaws impact a wide assortment of widely used open source libraries and frameworks. The affected third-party projects include Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts, and Apache ActiveMQ.
The operational impacts of these high-severity vulnerabilities vary. Many of them are categorized as denial-of-service (DoS) issues. Others are described by security researchers as cryptographic weaknesses, authentication and authorization problems, server-side request forgery (SSRF), information disclosure bugs, and arbitrary code execution vulnerabilities.
Mitigation and Risk Assessment
Despite the high number of tracked entries, Atlassian maintains that the CVEs reported in its monthly security bulletin have been assessed as presenting a non-critical risk to its customer base. Moreover, the company made no mention of any of these specific third-party vulnerabilities being actively exploited in the wild.
To protect environments from potential compromise, Atlassian recommends updating systems to the latest product versions or applying the specific fixed releases outlined in its documentation. Security analysts stress that organizations should maintain timely patching schedules, noting that threat actors frequently exploit known vulnerabilities rapidly after proof-of-concept material emerges, as previously demonstrated by attacks targeting issues like CVE-2026-21589.
Sources
- SecurityWeekAtlassian Patches 75 Flaws in Data Center and Server Products
Continue chronologically
Related stories
Atlassian Patches Critical Vulnerability Affecting 8 Products
Atlassian has released critical security patches for an unauthenticated arbitrary file access vulnerability impacting eight enterprise products.
Threat Actors Target Critical Atlassian Vulnerability CVE-2026-21589
Threat actors are actively targeting critical vulnerability CVE-2026-21589 in Atlassian self-hosted Data Center products just hours after technical details emerged.
Hackers Exploit Critical Atlassian Flaw After Public PoC
Threat actors are actively exploiting a critical Atlassian vulnerability tracked as CVE-2026-21589 following the release of technical reports and PoC code.
Atlassian and OpenAI Expand Partnership to Power Enterprise AI
Atlassian and OpenAI expand their partnership, integrating frontier models to power AI experiences, Rovo, and developer tools like Codex.
