Atlassian Patches 75 Third-Party Flaws in Data Center and Server Products

https://www.securityweek.com/wp-content/uploads/2023/01/Cybersecurity_News-SecurityWeek.jpg

Atlassian on Tuesday published its October 2026 security bulletin, which lists 162 high-severity and 14 critical-severity vulnerabilities.

All of the entries are tied to third-party dependencies, and many CVEs appear under several products. By SecurityWeek’s count, the bulletin covers 75 unique CVEs, six of them rated critical.

The affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.

The critical-severity flaws are:

  • CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525 – Apache Tomcat issues listed for Confluence and Crowd.
  • CVE-2026-58062 – a Bouncy Castle issue listed for Confluence, Crowd, Jira Software, and Jira Service Management.
  • CVE-2026-75595 – a Netty issue listed for Confluence, Jira Software, and Jira Service Management.
  • CVE-2026-77185 – an Apache SSHD issue listed for Fisheye/Crucible.

For each of these, Atlassian notes that its use of the affected component “presents a lower, non-critical assessed risk.”

Atlassian’s vulnerability disclosure portalalso lists CVE-2026-65905, a critical-severity Apache Tomcat flaw affecting...

Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE