Atlassian Patches 75 Flaws in Data Center and Server Products

What it is

Atlassian's October 2026 security bulletin (published Tuesday, 20 October 2026) lists 162 high-severity and 14 critical-severity third-party dependency vulnerabilities. Many CVEs repeat across products. SecurityWeek counts 75 unique CVEs, six of them critical. Affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.

Preconditions / Affected

The six critical CVEs and where Atlassian lists them:

The high-severity entries cover Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts and Apache ActiveMQ. Many are denial of service. Others are cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure and code execution bugs. The page gives no per-CVE detail for the high-severity set.

What to do

Atlassian recommends updating to the latest product versions or to the fixed releases listed in the bulletin. The page names no version numbers, so take them from the bulletin itself.

Check CVE-2026-65905 separately. Atlassian's disclosure portal lists it as a critical Apache Tomcat flaw affecting Data Center and Crowd, disclosed 20 October. It is absent from the bulletin. A check that uses only the bulletin would miss it. The portal also lists fewer unique CVEs than the bulletin, so the two sources do not match.

Caveats

For each critical CVE, Atlassian says its use of the component "presents a lower, non-critical assessed risk." It states that CVEs in monthly bulletins are assessed as non-critical for customers. It does not say any of these flaws are exploited. This is Atlassian's own assessment, and the page does not independently verify it.

SecurityWeek notes that attackers often exploit Atlassian flaws quickly. Its example is CVE-2026-21589, a critical flaw in self-hosted Data Center products that was targeted within hours of a public proof of concept.