Atlassian has released its October 2026 security bulletin, which fixes dozens of vulnerabilities in open source and third-party components bundled with its self-managed products. Six of the flaws are rated critical.
The bulletin, published on Tuesday, October 20, lists 176 vulnerability entries: 14 rated critical and 162 rated high. Many CVEs appear more than once because the same vulnerable dependency ships in several products. After removing duplicates, the bulletin covers 75 unique CVEs, six of them critical.
All of the entries come from third-party dependencies. The bulletin includes no flaws in Atlassian's own code.
The affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.
Tomcat, Bouncy Castle, Netty and Apache SSHD Behind the Critical Entries
Apache Tomcat accounts for half of the critical vulnerabilities:
- CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525 (Apache Tomcat) affect Confluence and Crowd.
- CVE-2026-58062 (Bouncy Castle) affects Confluence, Crowd, Jira Software and Jira Service Management.
- CVE-2026-75595 (Netty) affects Confluence, Jira Software and Jira Service Management.
- CVE-2026-77185 (Apache SSHD) affects Fisheye/Crucible.
Atlassian notes that these CVEs are rated critical for the libraries themselves, not for its products. In each case, the company says the way its products use the affected component presents a lower, non-critical assessed risk.
That matches Atlassian's general position on its monthly bulletins: it says every CVE reported in them has been assessed as non-critical for its customers.
Denial of Service Dominates the High-Severity Flaws
The high-severity entries affect a broad set of widely used Java and Java Script libraries: Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts and Apache Active MQ.
Many of them are denial-of-service issues. Others involve cryptographic weaknesses, authentication and authorization problems, server-side request forgery (SSRF), information disclosure and code execution.
A Critical Tomcat Flaw Missing From the Bulletin
The bulletin does not match Atlassian's vulnerability disclosure portal exactly.
The portal also lists CVE-2026-65905, a critical Apache Tomcat vulnerability affecting Data Center products and Crowd, disclosed on October 20. It does not appear in the October bulletin. The portal
also lists fewer unique CVEs overall than the bulletin.
Organizations that track Atlassian exposure should check both sources rather than rely on the bulletin alone.
No Exploitation Reported, but History Argues for Speed
Atlassian makes no mention of any of these vulnerabilities being exploited in attacks
Still, self-hosted Atlassian deployments have long been a favorite target. Earlier this year, attackers began exploiting CVE-2026-21589, a critical flaw in Atlassian's Data Center products, within hours of a public proof-of-concept exploit appearing.
Atlassian recommends that customers update to the latest product versions or to the fulletin.
Atlassian's " non-critical " assessment rests on how its products use each library, and that can change whenever a new exploitation technique appears. For internet-facing Jira, Confluence and Bitbucket servers, the safest approach is to apply the October updates on a normal, prompt patcr evidence of attacks.