Atlassian has rolled out an extensive security update for October 2026, targeting 176 vulnerabilities across popular products such as Jira, Confluence, Bamboo, Bitbucket, and Crowd. Released on October 20, this update includes 162 high-severity and 14 critical-severity third-party vulnerabilities, urging administrators to apply the necessary patches promptly.
Breakdown of Vulnerabilities
The update’s 176 entries should not be interpreted as unique CVEs affecting only Jira and Confluence. Instead, the vulnerabilities are distributed across various products, with some CVE identifiers recurring due to shared software libraries. This requires administrators to review each product individually rather than relying on a single comprehensive patch.
Among the critical issues is CVE-2026-65637, found in Confluence, involving a man-in-the-middle vulnerability in the Apache Tomcat Coyote component, with a CVSS score of 9.8. Other notable critical vulnerabilities include CVE-2026-58062, a cryptographic failure in Bouncy Castle rated 9.3, and CVE-2026-75595, an authentication flaw in Netty rated 9.1.
Impact on Products and Recommendations
Confluence is affected by improper authorization issues, notably CVE-2026-65182 and CVE-2026-68525, impacting the Tomcat Catalina component. These vulnerabilities are accompanied by high-severity concerns such as denial of service and remote code execution in third-party components. However, Atlassian clarifies that critical ratings apply to vulnerabilities in external libraries, and their implementation in Atlassian products poses a lesser risk.
Administrators should focus on upgrading to fixed versions, with Confluence upgrades recommended to versions 11.0.0, 10.2.19 LTS, and 9.2.26 LTS. Bamboo users should look to version 12.1.12 LTS or 10.2.24 LTS, while Bitbucket updates include versions 10.5.1 and 9.4.26 LTS. It’s crucial to verify specific build versions to ensure complete protection.
Ensuring Robust Security Measures
Atlassian emphasizes the importance of matching each installed application to its corresponding patch, including those sharing vulnerable libraries. This meticulous approach is vital to safeguarding systems against potential threats. Historical attacks, such as those involving CVE-2023-22527, underline the necessity of prompt updates to prevent exploitation.
Finally, Atlassian advises customers to consult the detailed release notes, as updates are based on information available as of October 20. Regularly updating defenses and integrating threat intelligence feeds from various security operations centers can further bolster protection against emerging threats.
