Atlassian has recently addressed a significant number of vulnerabilities in its Data Center and Server products as part of its October 2026 security update. Detailed in the latest bulletin, the company identified 162 high-severity and 14 critical-severity vulnerabilities, all linked to third-party components.
Details of the Vulnerabilities
The report indicates that these vulnerabilities span across several products, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. SecurityWeek’s analysis shows that the bulletin specifically covers 75 unique CVEs, with six of them classified as critical.
Among the critical vulnerabilities are multiple issues related to Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD, impacting products such as Confluence, Crowd, and Jira. Atlassian emphasizes that while these components are affected, the associated risk is considered non-critical.
Critical Vulnerabilities Explained
Notably, the critical flaws include CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525, all concerning Apache Tomcat and affecting Confluence and Crowd. CVE-2026-58062 pertains to a Bouncy Castle vulnerability impacting multiple Atlassian products. Additionally, CVE-2026-75595 and CVE-2026-77185 address issues in Netty and Apache SSHD, respectively.
Furthermore, Atlassian’s vulnerability disclosure portal lists another critical Apache Tomcat flaw, CVE-2026-65905, affecting Data Center and Crowd. Interestingly, this CVE was not included in the bulletin, highlighting discrepancies between the bulletin and the portal’s disclosures.
Recommendations and Future Outlook
Atlassian advises users to update their software to the latest versions or apply the patches provided in the bulletin to mitigate these vulnerabilities. The company assures that no current evidence suggests exploitation of these vulnerabilities in real-world attacks. However, prompt updates are crucial as cyber actors can rapidly exploit newly published vulnerabilities.
Keeping Atlassian products up to date is vital for organizations, as exemplified by the swift targeting of CVE-2026-21589 in the past. This proactive approach helps mitigate potential risks posed by vulnerabilities in widely used open-source libraries, such as Apache Tomcat and Netty.
In conclusion, while Atlassian has addressed these vulnerabilities, staying vigilant and updating systems promptly remains essential for maintaining cybersecurity integrity.
