Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities
Atlassian and Splunk release patches for over 250 vulnerabilities, including critical and high-severity flaws.
Summary
Atlassian and Splunk have collectively released patches for over 250 vulnerabilities across their product suites. Atlassian addressed 10 critical and 162 high-severity issues in third-party dependencies affecting products like Bamboo, Bitbucket, Confluence, and Jira. Splunk fixed at least 150 vulnerabilities in Splunk Enterprise, SOAR, and Universal Forwarder, with several critical and high-severity flaws also stemming from third-party libraries. Exploitation of these vulnerabilities could lead to remote code execution, data theft, and other serious impacts.
Full text
Atlassian and Splunk this week announced patches for over 250 vulnerabilities across their products, including dozens of critical- and high-severity flaws. On Tuesday, Atlassian published a Security Bulletin detailing 10 critical- and 162 high-severity issues in third-party dependencies, patched with fresh security updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira. Because the vulnerable libraries are used across multiple products, many of the patched security defects affect multiple products. Overall, the fixes appear to address approximately 109 unique CVEs. Successful exploitation of the bugs could allow attackers to mount remote code execution (RCE), denial-of-service (DoS), information theft, man-in-the-middle (MitM), authentication bypass, server-side request forgery (SSRF), and other types of attacks. On Wednesday, Splunk announced fixes for at least 150 vulnerabilities across Splunk Enterprise, SOAR, Universal Forwarder, and their associated apps and plugins, including issues impacting third-party libraries. Dozens of flaws are critical- and high-severity vulnerabilities, and some of them deserve special attention, Splunk says.Advertisement. Scroll to continue reading. Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 were rolled out with fixes for 60 vulnerabilities, three of which have a ‘critical’ severity rating. At least two dozen security defects, including critical ones, were addressed in third-party packages in the product. Critical bugs were also resolved with fresh versions of Splunk Apps and Add-ons (including AI Toolkit, Connect for Kafka, MCP Server app, and On-Call) and Splunk SOAR. Multiple defects in third-party dependencies in SOAR were also fixed. Splunk rolled out Enterprise Security version 8.6.1 with patches for two high-severity issues, updated SOAR Connectors to resolve 17 medium- and low-severity flaws, and released a Universal Forwarder update that addresses three medium-severity weaknesses in OpenSSL. Related: Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities Related: MLflow Vulnerability Exploited for Cloud Credential Theft Related: AI-Driven Vulnerability Surge Breaks the Traditional Patching Model Related: 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Prevalent AI Raises $22 Million to Expand Data Fabric PlatformUS Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of ThemCISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities943 Patches Rolled Out With Oracle’s August 2026 Security UpdateChrome, Firefox Updates Patch Dozens of VulnerabilitiesXpander Raises $7.5 Million for AI Management and Governance300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin FlawHeights Finance Data Breach Impacts at Least 1.2 Million Individuals Latest News Threat Actor Hacks 14,000 IP Cameras in Ukraine and RussiaMLflow Vulnerability Exploited for Cloud Credential TheftCisco Patches Critical Crosswork, Secure Workload VulnerabilitiesAI-Assisted Tool Helped Secure Satellite Communication System After 2022 Russian HackingOpenAI Overhauls Model Security With Sandboxing, 30-Minute Alerts, and Training PausesExploitation Expected for Critical Authentication Bypass Patched in Citrix NetScalerCritical GitLab Flaw Exploited Shortly After DisclosureHackers Using AI to Target Siemens PLCs in Critical US Sectors Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveDali Rajic is joining OpenAI as Chief Revenue Officer.Erika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email