[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fszRNyvuRSk6RII9COFQ1j392ZaXxKrP4taDJMz6li20":3},{"article":4,"iocs":49,"watch_terms":73,"solutions":74,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e881c5f9-9bf2-44b5-a615-f3be785ab037","Atlassian Patches 75 Flaws in Data Center and Server Products","atlassian-patches-75-flaws-in-data-center-and-server-products-87fa2c","Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components. The post Atlassian Patches 75 Flaws in Data Center and Server Products appeared first on SecurityWeek.","Atlassian's October security bulletin addresses 75 unique vulnerabilities across its Data Center and Server products, with six rated as critical. These flaws stem from third-party components like Apache Tomcat, Netty, and Bouncy Castle. While Atlassian assesses the risk as non-critical, the company recommends updating to the latest versions to mitigate potential exploitation.","Atlassian patches 75 vulnerabilities in Data Center and Server products, including 6 critical flaws.","https:\u002F\u002Fwww.securityweek.com\u002Fatlassian-patches-75-third-party-flaws-in-data-center-and-server-products\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F12\u002FAtlassian.jpg","2026-10-23T07:54:47+00:00","2026-10-23T10:00:05.074179+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Atlassian","vendor",{"name":21,"type":22},"Bamboo","product",{"name":24,"type":22},"Bitbucket",{"name":26,"type":22},"Confluence",{"name":28,"type":22},"Crowd",{"name":30,"type":22},"Fisheye\u002FCrucible","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,56,58,61,64,67,70],{"type":51,"value":52,"context":53},"cve","CVE-2026-65637","Critical-severity Apache Tomcat issue affecting Confluence and Crowd.",{"type":51,"value":55,"context":53},"CVE-2026-65182",{"type":51,"value":57,"context":53},"CVE-2026-68525",{"type":51,"value":59,"context":60},"CVE-2026-58062","Critical-severity Bouncy Castle issue affecting Confluence, Crowd, Jira Software, and Jira Service Management.",{"type":51,"value":62,"context":63},"CVE-2026-75595","Critical-severity Netty issue affecting Confluence, Jira Software, and Jira Service Management.",{"type":51,"value":65,"context":66},"CVE-2026-77185","Critical-severity Apache SSHD issue affecting Fisheye\u002FCrucible.",{"type":51,"value":68,"context":69},"CVE-2026-65905","Critical-severity Apache Tomcat flaw affecting Data Center and Crowd.",{"type":51,"value":71,"context":72},"CVE-2026-21589","Critical flaw in Atlassian's self-hosted Data Center products that was exploited after PoC publication.",[18,21,24],{"controls":75,"vendors":162},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":106,"name":107,"problem":108,"products":109},"patch-management","Automated patch management","Known holes get closed in days, not months.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":48,"name":135,"problem":136,"products":137},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[138,146,154],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":175},"atlassian-patches-75-flaws-including-critical-third-party-component-vulnerabilities","Atlassian Patches 75 Flaws Including Critical Third-Party Component Vulnerabilities","Atlassian's October bulletin reveals 75 vulnerabilities across its Data Center and Server products, six of which are rated critical — many originating from third-party libraries like Apache Tomcat, Netty, and Bouncy Castle. This highlights a growing supply chain risk: organizations inherit vulnerabilities from every open-source or third-party component embedded in their software stack. Even when a vendor assesses overall risk as non-critical, unpatched critical flaws in widely used enterprise platforms represent attractive targets for threat actors. Delaying updates because the vendor's risk rating seems manageable can leave organizations exposed to exploitation chains that elevate severity in real-world environments.",[168,169,170,171,172,173,174],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":176,"PCI DSS Requirement 6":177,"NIST SP 800-53 SI-2: Flaw Remediation":178,"OWASP A06:2021 Vulnerable and Outdated Components":179,"CIS Control 7: Continuous Vulnerability Management":180,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":181,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":182},"NIS2 requires essential and important entities to implement measures for handling vulnerabilities and patch management as part of their cybersecurity risk management obligations, covering the need to act on Atlassian's security bulletin promptly.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches, making it directly relevant for any organization running Atlassian products in a cardholder data environment.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined timeframes, which would enforce timely application of Atlassian's patches before exploitation occurs.","This OWASP risk category specifically addresses the danger of using components with known vulnerabilities — precisely the scenario here, where embedded libraries like Bouncy Castle and Apache Tomcat introduced critical flaws into Atlassian products.","This control mandates a continuous process of identifying, prioritizing, and remediating vulnerabilities — directly applicable here, where 75 flaws including six critical ones require timely patching of Atlassian products and their embedded components.","This control requires organizations to obtain timely information about technical vulnerabilities in used systems and take appropriate measures, directly covering the need to track and patch third-party component flaws like those in Apache Tomcat and Netty.","Unpatched vulnerabilities in Data Center and Server products can be exploited to bypass access controls; maintaining patched systems is a prerequisite for ensuring that authentication and access mechanisms function as intended."]