Atlassian October bulletin lists 176 flaw entries in Jira and Confluence
Original title: Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence
Critical scores are third-party library ratings; Atlassian says its product risk is lower and not immediately critical.
Atlassian’s October 20, 2026 bulletin covers 176 flaw entries across Jira, Confluence, Bamboo, Bitbucket, and Crowd: 162 high and 14 critical third-party entries. Some CVE identifiers repeat across products that share libraries, so the count is not 176 unique Jira and Confluence flaws. Atlassian says fixes shipped in versions released last month and urges customers to install a suitable fixed release. It says the critical scores describe outside libraries and that its use of them is a lower, non-critical risk. The bulletin is not evidence that the October findings are being exploited.
Unconfirmed: Atlassian says library critical scores do not mean every installation faces the same exposure.
- Confluence Data Center fixes include 11.0.0, 10.2.19 LTS, and 9.2.26 LTS.
- Affected Confluence branches include 10.2.0–10.2.18 and 9.2.0–9.2.25.
- Bamboo fixes are 12.1.12 LTS or 10.2.24 LTS; Bitbucket includes 10.5.1, 10.2.8 LTS, and 9.4.26 LTS.
- CVE-2026-65637 is a Tomcat Coyote issue scored 9.8; other critical entries score 9.3 and 9.1.
- A separate Jira file-access advisory, CVE-2026-21589, is not part of this bulletin.
Impact: Third-party flaws including RCE, auth, and path traversal; lower assessed product risk
| Product | Affected | Fixed in |
|---|---|---|
| Atlassian Confluence Data Center | 10.2.0 through 10.2.18, 9.2.0 through 9.2.25, and several older releases | 11.0.0, 10.2.19 LTS, 9.2.26 LTS |
| Atlassian Bamboo | — | 12.1.12 LTS or 10.2.24 LTS |
| Atlassian Bitbucket | — | 10.5.1, 10.2.8 LTS, 9.4.26 LTS |
| Atlassian Jira | — | — |
| Atlassian Crowd | — | — |
- 1.Install the listed fixed Data Center release for each installed Atlassian product.
- 2.Compare the exact build with the October 20 table and linked release notes.
- 3.Do not treat the separate Jira CVE-2026-21589 advisory as part of this bulletin.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58062 | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate | 9.3 | <1% | ||
CVE-2026-65637+2 related CVEs | Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990 | 9.8 group max | <1% | ||
| CVE-2026-75595 | Netty: Io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a… | 9.1 | <1% |
From the original article
2 min read at cybersecuritynews.com
Atlassian has released its October 2026 security bulletin, covering 176 flaw entries across products including Jira, Confluence, Bamboo, Bitbucket, and Crowd. Published on October 20, the update lists 162 high-severity entries and 14 critical-severity third-party entries. Atlassian says it included fixes in product versions released last month and urges customers to install a suitable fixed […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.