Atlassian October bulletin fixes 75 flaws in third-party components

Atlassian published its October bulletin on Oct. 20, 2026, listing entries across Data Center and Server products; SecurityWeek counts 75 unique CVEs among them, and every entry involves a third-party component rather than Atlassian’s own code.

The bulletin covers Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management for both Data Center and Server products. SecurityWeek independently counts 75 unique CVEs in the bulletin, rating six of them critical, since many CVEs show up under multiple products. The critical Apache Tomcat entries are CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525 for Confluence and Crowd; CVE-2026-58062 for Bouncy Castle spans Confluence, Crowd, Jira Software and Jira Service Management; CVE-2026-75595 for Netty covers Confluence, Jira Software and Jira Service Management; and CVE-2026-77185 for Apache SSHD affects Fisheye/Crucible. OffSeq Threat Radar said the bulletin’s 14 critical-severity issues mainly sit in third-party components including Apache Tomcat, Bouncy Castle, Netty and Apache SSHD.

High-severity flaws outside the critical set touch open-source libraries such as Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts and Apache ActiveMQ. Code execution bugs, information disclosure, SSRF (server-side request forgery), authentication and authorization problems, cryptographic weaknesses and denial-of-service bugs all appear in the bulletin’s issue types, and the high-severity set is heavily weighted toward denial-of-service.

Atlassian said each affected component’s use in its products carries a lower, non-critical assessed risk, and the company stated “CVEs reported in monthly Security Bulletins have been assessed as presenting a non-critical risk to Atlassian customers.” The vendor has not said that attackers exploited any October bulletin vulnerability, and it rates customer exposure to these third-party component flaws lower and non-critical with no sign of active exploitation in the wild. That assessment covers the full monthly bulletin, including the Oct. 2026 bulletin’s third-party component flaws, and characterizes customer risk as lower. OffSeq Threat Radar said Atlassian’s lower, non-critical risk assessment for the bulletin means customers need no immediate emergency action beyond standard patching practices.

SecurityWeek points to CVE-2026-21589 as a case where attackers started targeting the flaw within hours after a proof of concept surfaced, illustrating how quickly actors can weaponize disclosed Atlassian flaws. Atlassian’s disclosure portal contains fewer unique CVEs than the bulletin, a gap the outlet highlights between the two counts. The portal also includes CVE-2026-65905, a Tomcat flaw rated critical that affects Data Center and Crowd, in its Oct. 20, 2026 disclosures, even though that CVE is absent from the October bulletin. Atlassian recommends moving to the latest product versions or to the fixed releases published in the bulletin.