Atlassian Patches 176 Flaws in Jira, Confluence and Other Data Center Products
Do Son 
TL;DR
The October 2026 Atlassian security bulletin, published on October 20, fixes 176 vulnerabilities across its self-managed products. That includes 14 critical and 162 high-severity entries, all tied to third-party components. Atlassian says none of them pose a critical risk in its products, but admins should still upgrade.
- Total: 6 CVEs
- Severity: 6 Critical
- Actively exploited: None confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-65637
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-65637 | 9.8 | CWE-20 | — | Not exploited |
| CVE-2026-58062 | 9.3 | Stapled OCSP response accepted without binding to the checked certificate | 1.85, 2.73.12, 2.0.2 (+1) | Not exploited |
| CVE-2026-75595 | 9.1 | SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext | — | Not exploited |
| CVE-2026-65182 | 9.1 | CWE-284 | — | Not exploited |
| CVE-2026-68525 | 9.1 | CWE-863 | — | Not exploited |
| CVE-2026-77185 | 9.1 | CWE-305 | 2.20.0, 3.0.0-M6 | Not exploited |
Why It Matters
Jira, Confluence and Bitbucket hold some of the most sensitive data a company owns. They store source code, project plans, credentials and internal documents. Attackers have targeted self-managed Atlassian servers many times in the past. In 2023, for example, attackers exploited Confluence zero-days soon after disclosure.
This month’s Atlassian security bulletin is unusual in one way. Every critical entry comes from an open-source library that Atlassian bundles, not from Atlassian’s own code. These third-party vulnerabilities sit in Apache Tomcat, Bouncy Castle, Netty and Apache SSHD.
Bundled libraries are a common weak spot. A single flaw in Tomcat or Netty can ripple into dozens of products at once. As a result, vendors must track and update every component they ship. Atlassian says it finds these issues through its “Bug Bounty program, pen-testing processes, and third-party library scans.”
How Atlassian rates the risk
Atlassian stresses that the library scores do not reflect real risk in its products. For each critical item, it states that “Atlassian’s application of this dependency presents a lower, non-critical assessed risk.”
The bulletin also explains the bigger picture. “CVEs reported in monthly Security Bulletins have been assessed as presenting a non-critical risk to Atlassian customers,” it says. For true emergencies, Atlassian instead “issues Critical Security Advisories” outside the monthly schedule.
In other words, a 9.8 score on a library does not mean a 9.8 risk in Confluence. The vulnerable code path may not be reachable in Atlassian’s setup. Still, Atlassian does not publish its own scores for these items, so defenders cannot easily verify that claim.
How the Attacks Work
The 14 critical entries map to six unique CVEs. Several of them appear in more than one product.
The critical third-party vulnerabilities
- CVE-2026-65637 (CVSS 9.8): a man-in-the-middle flaw in the Apache Tomcat connector. It affects Confluence and Crowd.
- CVE-2026-58062 (CVSS 9.3): a cryptographic flaw in the Bouncy Castle library. It affects Confluence, Crowd, Jira Software and Jira Service Management.
- CVE-2026-75595 (CVSS 9.1): a Netty flaw. Atlassian labels it remote code execution in Jira and an authentication issue in Confluence.
- CVE-2026-65182 and CVE-2026-68525 (CVSS 9.1): improper authorization bugs in Tomcat, found in Confluence and Crowd.
- CVE-2026-77185 (CVSS 9.1): an authentication flaw in Apache SSHD, bundled with Crucible.
High-severity fixes
The 162 high-severity entries follow the same pattern. Most are denial-of-service, cryptographic or SSRF flaws in shared libraries. For example, Bamboo alone patches more than two dozen issues in Netty, Bouncy Castle, Tomcat, ActiveMQ and nanoid.
Why patching Tomcat alone is not enough
The Tomcat entries are flaws that Apache disclosed in its own Tomcat advisories. However, Atlassian ships its own bundled Tomcat build, so customers must wait for Atlassian updates rather than patching Tomcat directly.
Exploitation status
Atlassian does not report exploitation in the wild for any of these flaws. Likewise, no public proof-of-concept targeting the Atlassian products has been confirmed.
Affected Products and Fixed Versions
The bulletin covers Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. Recommended fixed releases include:
- Confluence Data Center: 11.0.0, 10.2.19 (LTS) or 9.2.26 (LTS)
- Jira Software and Jira Service Management: 11.3.12 (LTS) or 10.3.26 (LTS)
- Crowd Data Center: 7.2.4
- Fisheye/Crucible: 4.9.15
- Bamboo: 12.1.12 (LTS) or 10.2.24 (LTS)
- Bitbucket: 10.5.1, 10.2.8 (LTS) or 9.4.26 (LTS)
Affected version ranges vary by product and branch. Atlassian notes that its fixed versions “are current as of October 20, 2026.”
Patch and Mitigation Steps
- Upgrade each self-managed product to the latest release or a listed fixed version.
- Prioritize internet-facing Confluence, Jira and Crowd instances.
- Use Atlassian’s Vulnerability Disclosure Portal to check your exact versions.
- Plan moves to supported LTS branches if you run older releases.
Even with Atlassian’s lower risk rating, this Atlassian security bulletin clears a large backlog of library flaws. Teams should fold these updates into their next maintenance window.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
