Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian's October 2026 security bulletin addresses 162 high-severity and 14 critical-severity entries, which SecurityWeek consolidates into 75 distinct CVEs, six of them critical, since many flaws are listed across multiple products. The affected software includes Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. The critical issues stem from third-party components: CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525 in Apache Tomcat (Confluence, Crowd), CVE-2026-58062 in Bouncy Castle (Confluence, Crowd, Jira Software, Jira Service Management), CVE-2026-75595 in Netty (Confluence, Jira Software, Jira Service Management), and CVE-2026-77185 in Apache SSHD (Fisheye/Crucible) — Atlassian says its actual exposure to these is lower than the upstream severity suggests. A separate critical Tomcat bug, CVE-2026-65905, impacting Data Center and Crowd, surfaces on Atlassian's vulnerability portal but is missing from the formal bulletin. The remaining high-severity bugs touch widely used libraries such as Jackson, Axios, Spring, Apache Struts, and Apache ActiveMQ, covering denial-of-service, cryptographic weaknesses, SSRF, information disclosure, and remote code execution risks. No active exploitation has been reported, but Atlassian urges customers to update promptly, recalling that attackers previously weaponized a past Atlassian flaw, CVE-2026-21589, within hours of a public proof-of-concept.