Atlassian October bulletin covers 75 third-party product CVEs
Original title: Atlassian Patches 75 Flaws in Data Center and Server Products
Six unique flaws are rated critical, but Atlassian assesses non-critical customer risk and cites no exploitation.
Atlassian’s October 2026 security bulletin lists 162 high-severity and 14 critical-severity entries, all in third-party dependencies. SecurityWeek counts 75 unique CVEs, six rated critical, across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. Atlassian says bulletin CVEs present a non-critical risk to customers and does not report exploitation. It recommends the latest versions or the fixed releases in the bulletin.
Unconfirmed: CVE-2026-65905 appears on Atlassian’s portal but not in the October bulletin, and the two listings disagree on unique CVE counts.
- Critical entries involve Apache Tomcat, Bouncy Castle, Netty and Apache SSHD.
- Many remaining high-severity issues are denial-of-service flaws in common libraries.
- Portal entry CVE-2026-65905 is absent from the bulletin.
- The bulletin and disclosure portal list different unique CVE counts.
Impact: Third-party flaws including code execution, SSRF, auth issues and DoS
| Product | Affected | Fixed in |
|---|---|---|
| Atlassian Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, Jira Service Management | — | latest product versions or fixed releases listed in the bulletin |
- 1.Update affected Atlassian products to the latest versions or bulletin fixed releases.
- CVEs
- CVE-2026-65637CVE-2026-65182CVE-2026-68525CVE-2026-58062CVE-2026-75595CVE-2026-77185CVE-2026-65905
- Vendors
- Atlassian
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58062 | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate | 9.3 | <1% | ||
CVE-2026-65905+3 related CVEs | Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator | 9.8 group max | <1% | ||
| CVE-2026-75595 | Netty: Io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a… | 9.1 | <1% | ||
| CVE-2026-77185 | Critical Authentication Bypass in Apache MINA SSHD (Asynchronous Auth Flaw) | 9.1 | — |
From the original article
2 min read at securityweek.com
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components. The post Atlassian Patches 75 Flaws in Data Center and Server Products appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.