Atlassian on Tuesday published its October 2026 security bulletin, which lists 162 high-severity and 14 critical-severity vulnerabilities.
All of the entries are tied to third-party dependencies, and many CVEs appear under several products. By SecurityWeek’s count, the bulletin covers 75 unique CVEs, six of them rated critical.
The affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.
The critical-severity flaws are:
- CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525 – Apache Tomcat issues listed for Confluence and Crowd.
- CVE-2026-58062 – a Bouncy Castle issue listed for Confluence, Crowd, Jira Software, and Jira Service Management.
- CVE-2026-75595 – a Netty issue listed for Confluence, Jira Software, and Jira Service Management.
- CVE-2026-77185 – an Apache SSHD issue listed for Fisheye/Crucible.
For each of these, Atlassian notes that its use of the affected component “presents a lower, non-critical assessed risk.”
Atlassian’s vulnerability disclosure portal also lists CVE-2026-65905, a critical-severity Apache Tomcat flaw affecting Data Center and Crowd, among the issues disclosed on October 20. However, the CVE doesn’t appear in the bulletin, and the portal lists fewer unique CVEs than the bulletin does.
The remaining high-severity flaws affect widely used open source libraries, including Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts, and Apache ActiveMQ.
Many of them are denial-of-service (DoS) issues. Others are described as cryptographic weaknesses, authentication and authorization problems, server-side request forgery (SSRF), information disclosure, and code execution bugs.
“CVEs reported in monthly Security Bulletins have been assessed as presenting a non-critical risk to Atlassian customers,” the company says.
Atlassian makes no mention of any of these vulnerabilities being exploited in attacks. It recommends updating to the latest product versions or to the fixed releases listed in the bulletin.
Organizations should keep their Atlassian products up to date, as threat actors often quickly exploit vulnerabilities. One example is CVE-2026-21589, a critical flaw in Atlassian’s self-hosted Data Center products that attackers began targeting within hours of a PoC being published.
Related: Atlassian Patches Critical Vulnerability Affecting 8 Products
Related: Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data
Related: Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities
