Atlassian October bulletin covers 75 third-party product CVEs
Six unique flaws are rated critical, but Atlassian assesses non-critical customer risk and cites no exploitation.
2
Stories per day · 30 days
4 RSS
Relatedatlassian5jira5bitbucket4bamboo2kev2arbitrary-file-access1cisa1crowd1cve-2026-215891path-traversal1third-party1third-party-libraries1tomcat1
10 stories, newest first · one card per story
Stories tagged #confluence
Canada flags Atlassian Data Center and Server flaws (AV26-1076)
The October 22 alert lists affected Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, and Jira Service Management builds.
Atlassian October bulletin lists 176 flaw entries in Jira and Confluence
Critical scores are third-party library ratings; Atlassian says its product risk is lower and not immediately critical.
3
U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Atlassian CVE-2026-21589 to KEV, ordering federal fixes by October 18, 2026.
CISA lists Atlassian file-access flaw CVE-2026-21589 as exploited
Unauthenticated attackers can read a known file in the web root; federal remediation is due October 18, 2026.
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Attackers probed critical Atlassian CVE-2026-21589 within hours of a public PoC, with 190 honeypot attempts.
5
Hackers exploit critical Atlassian flaw after public PoC release
Attackers began exploiting critical Atlassian flaw CVE-2026-21589 within hours of a public proof of concept.
3
Atlassian warns of critical file access flaw in its datacenter products
Atlassian urges patches for CVE-2026-21589, an unauthenticated file-read flaw in eight Data Center products.
4
Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware
Feral Wolf exploited Atlassian Confluence and 1C:Enterprise flaws to deploy GenieLocker ransomware across Russian retail, construction, manufacturing and IT firms.
3
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
2