Security Update Details
Atlassian announced in its October 2026 security bulletin the resolution of a wide range of security vulnerabilities affecting its server and data center products. The updates included 75 unique security vulnerabilities, all associated with third-party software dependencies, with severity levels ranging from high to critical.
A broad suite of the company's products was affected by these vulnerabilities, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, as well as Jira Software and Jira Service Management.
Critical Vulnerabilities and Affected Components
Out of the 75 vulnerabilities, 6 were classified as "Critical" and are distributed across commonly used software components:
- Apache Tomcat: Vulnerabilities (CVE-2026-65637, CVE-2026-65182, CVE-2026-68525) affecting Confluence and Crowd.
- Bouncy Castle: Vulnerability (CVE-2026-58062) affecting Confluence, Crowd, and Jira.
- Netty: Vulnerability (CVE-2026-75595) affecting Confluence and Jira.
- Apache SSHD: Vulnerability (CVE-2026-77185) affecting Fisheye/Crucible.
Despite the "critical" classification of these vulnerabilities, Atlassian noted that its usage of these components in its own environments mitigates the actual risk level, considering them non-critical risks for its customers.
Why This News Matters
The importance of this update lies in its reliance on widely used open-source software libraries such as Jackson, Axios, Spring, and Apache Struts. The nature of these vulnerabilities varies between Denial of Service (DoS) attacks, encryption issues, authentication and authorization flaws, as well as Server-Side Request Forgery (SSRF) and remote code execution vulnerabilities.
Although there are no reports of active exploitation of these vulnerabilities in actual attacks, the company urges organizations to immediately update their products to the latest available versions. This recommendation comes in light of the company's history with previous vulnerabilities, such as (CVE-2026-21589), which attackers exploited very quickly after the publication of its proof-of-concept (PoC).