ATLASSIAN has published its October 2026 security bulletin, revealing 162 high-severity and 14 critical-severity vulnerabilities, all rooted in third‑party components used across its Data Center and server products. SecurityWeek’s tally identifies 75 unique CVEs within the bulletin, six of which are rated critical. The affected Atlassian products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.
The six critical flaws include CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525 (Apache Tomcat) affecting Confluence and Crowd; CVE-2026-58062 (Bouncy Castle) listed for Confluence, Crowd, Jira Software and Jira Service Management; CVE-2026-75595 (Netty) affecting Confluence, Jira Software and Jira Service Management; and CVE-2026-77185 (Apache SSHD) listed for Fisheye/Crucible. Atlassian notes that the use of the affected components “presents a lower, non‑critical assessed risk” for these items.
The bulletin also references CVE-2026-65905 (a critical Tomcat flaw) on its vulnerability portal, though that CVE does not appear in the bulletin itself.
Beyond the critical issues, the remaining high‑severity entries affect multiple widely used open‑source libraries, including Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts and ActiveMQ. They cover a range of impact areas such as DoS, cryptographic weaknesses, authentication/authorization, SSRF, information disclosure and potential code execution.
Atlassian urges updating to the latest fixed releases, noting that threat actors often exploit unpatched installations, with a notable example being CVE-2026-21589, which saw rapid exploitation after PoC publication.