Back to Feed
VulnerabilitiesOct 23, 2026

Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian patches 75 vulnerabilities in Data Center and Server products, including 6 critical flaws.

Vendor Watch

Run Atlassian?

Get an email when a reviewed story names Atlassian, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

Summary

Atlassian's October security bulletin addresses 75 unique vulnerabilities across its Data Center and Server products, with six rated as critical. These flaws stem from third-party components like Apache Tomcat, Netty, and Bouncy Castle. While Atlassian assesses the risk as non-critical, the company recommends updating to the latest versions to mitigate potential exploitation.

The lesson from this incident

Full lesson

Atlassian's October bulletin reveals 75 vulnerabilities across its Data Center and Server products, six of which are rated critical — many originating from third-party libraries like Apache Tomcat, Netty, and Bouncy Castle. This highlights a growing supply chain risk: organizations inherit vulnerabilities from every open-source or third-party component embedded in their software stack. Even when a vendor assesses overall risk as non-critical, unpatched critical flaws in widely used enterprise platforms represent attractive targets for threat actors. Delaying updates because the vendor's risk rating seems manageable can leave organizations exposed to exploitation chains that elevate severity in real-world environments.

What helps against this

How we list vendors

Indicators of Compromise

  • cve — CVE-2026-65637
  • cve — CVE-2026-65182
  • cve — CVE-2026-68525
  • cve — CVE-2026-58062
  • cve — CVE-2026-75595
  • cve — CVE-2026-77185
  • cve — CVE-2026-65905
  • cve — CVE-2026-21589

Entities

Atlassian (vendor)Bamboo (product)Bitbucket (product)Confluence (product)Crowd (product)Fisheye/Crucible (product)