Atlassian and Splunk have issued security updates to fix dozens of critical and high-severity vulnerabilities across their product portfolios. Atlassian patched 10 critical and 162 high-severity issues primarily in third-party dependencies affecting Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira, covering about 109 unique CVEs. Splunk addressed at least 150 vulnerabilities in Splunk Enterprise, SOAR, Universal Forwarder, and related apps, including critical flaws in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 of Splunk Enterprise. The vulnerabilities could enable remote code execution, privilege escalation, information theft, denial-of-service, man-in-the-middle attacks, authentication bypass, and server-side request forgery. The updates include fixes for third-party library issues and multiple Splunk apps and add-ons. No exploits in the wild have been reported, and the vendors have released patches to mitigate these risks.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code remotely, steal sensitive information, elevate privileges, bypass authentication, cause denial-of-service conditions, perform man-in-the-middle attacks, and conduct server-side request forgery. The wide range of affected products and third-party dependencies increases the potential attack surface. However, no active exploitation has been reported so far.

Patches have been released by Atlassian and Splunk to address these vulnerabilities. Users and administrators should apply the latest security updates for all affected products and third-party dependencies as soon as possible. Since the vulnerabilities span multiple products and versions, consult the official Atlassian and Splunk security bulletins for detailed patching instructions and version-specific guidance. No additional mitigation steps are indicated beyond applying these official fixes.