Atlassian Patches 176 Vulnerabilities Across Jira, Confluence, and More
Atlassian has released a significant security update addressing 176 vulnerability entries, including 14 critical and 162 high-severity issues, primarily affecting third-party components in its popular collaboration and development tools.
Atlassian has issued a substantial security bulletin for October 2026, detailing fixes for 176 vulnerability entries across its widely used products such as Jira, Confluence, Bamboo, Bitbucket, and Crowd. The update, released on October 20, highlights 162 high-severity and 14 critical-severity issues, with a notable focus on vulnerabilities within third-party components like Apache Tomcat and Bouncy Castle.
While the bulletin lists 176 flaw entries, Atlassian clarifies that this total does not represent unique CVEs affecting Jira and Confluence exclusively. Instead, the findings are categorized by product, and some CVE identifiers appear across multiple applications that share common software libraries. This necessitates that administrators meticulously review each installed product for applicable patches rather than assuming a single update covers all potential risks.
Among the critical vulnerabilities identified, CVE-2026-65637 stands out. This man-in-the-middle vulnerability resides in the Apache Tomcat Coyote dependency and carries a severe CVSS score of 9.8. Other critical issues include CVE-2026-58062, a cryptographic failure in Bouncy Castle rated at CVSS 9.3, and CVE-2026-75595, an authentication and session management weakness in Netty with a CVSS score of 9.1. Confluence also faces two improper authorization vulnerabilities, CVE-2026-65182 and CVE-2026-68525, impacting its Tomcat Catalina dependency.
Atlassian emphasizes that the critical ratings primarily reflect the severity of flaws within the underlying third-party libraries. The company's implementation of these libraries may present a lower, non-critical risk in practice. Atlassian reserves its own critical security advisories for issues that pose an immediate and severe threat directly within its products. Therefore, the high CVSS scores of the library vulnerabilities do not automatically translate to an equivalent level of exposure for every affected Atlassian installation.
Specific fixed releases have been designated for various products. For Confluence Data Center, versions 11.0.0, 10.2.19 LTS, and 9.2.26 LTS are marked as fixed, with 10.2.19 LTS recommended. Affected branches include 10.2.0 through 10.2.18 and 9.2.0 through 9.2.25, alongside older releases. Administrators are urged to consult the detailed table in the security bulletin for precise version matching. Similar guidance is provided for Bamboo (12.1.12 LTS or 10.2.24 LTS) and Bitbucket (10.5.1, 10.2.8 LTS, and 9.4.26 LTS), with notes indicating these fixes are primarily for Data Center editions.
Jira administrators are also reminded of a separate, recent advisory concerning arbitrary file access vulnerabilities (CVE-2026-21589), which affects Jira Software and Jira Service Management. This should not be conflated with the third-party dependency issues detailed in the current monthly bulletin. The article references past incidents, such as attackers exploiting an older Confluence flaw (CVE-2023-22527) to deploy the Godzilla backdoor, underscoring the importance of timely patching, though it clarifies that there is no current evidence of exploitation for the newly disclosed October vulnerabilities.
Atlassian strongly advises customers to upgrade to the latest release or a specified fixed version for each affected product. Given that the fixed-version table is based on information available as of October 20, users should also review the linked release notes for each patch before deployment. The critical takeaway for administrators is to meticulously map every installed application to its corresponding patch path, paying close attention to products that share vulnerable libraries.