Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian's October 2026 security bulletin lists 75 unique CVEs affecting multiple Data Center and Server products, with 14 critical-severity flaws all tied to third-party dependencies like Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD. The affected products include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. The critical vulnerabilities include CVE-2026-65637, CVE-2026-65182, CVE-2026-68525 (Apache Tomcat), CVE-2026-58062 (Bouncy Castle), CVE-2026-75595 (Netty), and CVE-2026-77185 (Apache SSHD). Atlassian notes that the use of these components presents a lower, non-critical risk to their customers. The bulletin also covers high-severity issues affecting widely used open source libraries, with vulnerability types ranging from denial-of-service to code execution. Atlassian urges customers to update to the latest versions or fixed releases and states no known exploitation in the wild for these vulnerabilities.

The vulnerabilities affect multiple Atlassian Data Center and Server products through third-party components, potentially exposing them to denial-of-service, cryptographic weaknesses, authentication and authorization issues, SSRF, information disclosure, and code execution risks. However, Atlassian assesses the risk to their customers as lower and non-critical due to their specific use of the affected components. No active exploitation has been reported. Failure to update could leave systems exposed to these issues.

Atlassian recommends updating affected products to the latest versions or applying the fixed releases listed in their October 2026 security bulletin. Since Atlassian assesses the risk from these vulnerabilities as lower and non-critical, no immediate emergency action is required beyond standard patching practices. Organizations should maintain up-to-date Atlassian products to reduce exposure to potential exploits.