ATLASSIAN’S security bulletin, published on 20 October 2026, addresses 176 vulnerabilities across its self-managed products: 14 critical and 162 high-severity entries. The flaws are in third-party components bundled with products including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.
Atlassian says the affected dependencies include Apache Tomcat, Bouncy Castle, Netty and Apache SSHD, and assesses their use in its products as presenting a lower, non-critical risk. It reports no known exploitation in the wild, and no publicly confirmed proof-of-concept targeting Atlassian products.
The critical entries represent six unique CVEs. They include CVE-2026-65637, a Tomcat connector man-in-the-middle flaw affecting Confluence and Crowd; CVE-2026-58062, a Bouncy Castle cryptographic flaw affecting Confluence, Crowd and Jira products; and CVE-2026-75595, a Netty flaw described as remote code execution in Jira and an authentication issue in Confluence.
Other reported issues include Tomcat authorisation flaws CVE-2026-65182 and CVE-2026-68525, and an Apache SSHD authentication flaw, CVE-2026-77185, affecting Crucible. Atlassian says customers should update its products rather than patch bundled Tomcat separately.
Recommended fixed releases include Confluence Data Center 11.0.0, 10.2.19 or 9.2.26; Jira Software and Jira Service Management 11.3.12 or 10.3.26; Crowd 7.2.4; Fisheye/Crucible 4.9.15; Bamboo 12.1.12 or 10.2.24; and Bitbucket 10.5.1, 10.2.8 or 9.4.26. Version ranges vary, so administrators should check Atlassian’s guidance for their installations and upgrade to a listed fixed release or the latest available version.