Atlassian: October bulletin patches 75 third-party CVEs across Data Center and Server products (multiple CVEs incl. CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062, CVE-2026-75595, CVE-2026-77185)
Severity: high · Patch status: patched · Since 2026-10-20 · CVE-2026-21589, CVE-2026-58062, CVE-2026-65182, CVE-2026-65637, CVE-2026-65905, CVE-2026-68525, CVE-2026-75595, CVE-2026-77185
Atlassian's October 2026 security bulletin lists 176 vulnerability entries (162 high, 14 critical), covering 75 unique CVEs, all in third-party dependencies such as Apache Tomcat, Bouncy Castle, Netty, Apache SSHD, Jackson, Axios, Spring, Struts and ActiveMQ. Affected products include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. Critical unique CVEs include Tomcat issues CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525, Bouncy Castle CVE-2026-58062, Netty CVE-2026-75595 and Apache SSHD CVE-2026-77185; Atlassian assesses its use of these components as lower, non-critical risk. Flaw types include DoS, crypto weaknesses, auth issues, SSRF, information disclosure and code execution. No exploitation is reported. Fixes are available in the latest or bulletin-listed releases; a separate critical Tomcat flaw CVE-2026-65905 appears on the disclosure portal.
What to do
- Update all affected Atlassian Data Center/Server products to the latest versions or the fixed releases listed in the October 2026 bulletin, prioritising internet-facing Confluence, Jira and Crowd instances
- Check the Atlassian vulnerability disclosure portal for CVE-2026-65905 (critical Apache Tomcat flaw in Data Center and Crowd) and ensure the corresponding fix is applied
- Inventory which third-party components (Tomcat, Netty, Bouncy Castle, SSHD, Struts, ActiveMQ) your instances expose and review exposure to DoS, SSRF and code execution flaws
- Monitor Atlassian advisories and threat intel, as attackers have rapidly exploited Atlassian flaws in the past (e.g. CVE-2026-21589)
Fixed versions
- Latest product versions or fixed releases listed in the October 2026 bulletin
Sources
All live incidents on Threat Watch